{"action":"created","comment":{"url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/pulls/comments/30131027","id":30131027,"diff_hunk":"@@ -0,0 +1,125 @@\n+Le vocabulaire des permissions\n+##############################\n+\n+:date: 2015-05-12\n+:summary: Démystification du vocabulaire des permissions\n+\n+Nous sommes actuellement en train de réfléchir à ajouter la gestion\n+des permissions à notre service de stockage.\n+\n+Cela permet la mutualisation d'informations et la collaboration entre\n+divers intervenants sur les données.\n+\n+Or en creusant un peu on se rends compte que tous les intervenants\n+n'ont pas nécessairement les mêmes droits d'accès aux données.\n+\n+\n+Le concept de principal\n+=======================\n+\n+Un principal, en sécurité informatique, est une entité qui peut-être\n+authentifié par un système informatique. [#]_\n+\n+Il peut s'agir aussi bien d'un individu, d'un ordinateur, d'un service, d'un\n+processus, d'un thread ou d'un groupe regroupant l'une de ces entités.\n+\n+Les permissions sont alors associés à ces principals.\n+\n+Par exemple, un utilisateur est identifié de manière unique lors de la\n+connexion par le système d'authentification dont le rôle est de\n+définir une liste de principals pour l'utilisateur se connectant.\n+\n+.. [#] Pour en savoir plus sur les principals:\n+       https://en.wikipedia.org/wiki/Principal_%28computer_security%29\n+\n+\n+La différence entre rôle et groupe\n+==================================\n+\n+De but en blanc il n'est pas évident de définir précisément la\n+différence entre ces deux concepts qui permettent tous deux de donner\n+des permissions à un groupe de principals.\n+\n+- Un rôle est une liste de permissions que l'on associe à un principal.\n+- Un groupe est une liste de principals que l'on associe à une permission.\n+\n+\n+\n+La différence entre permission et ACL\n+=====================================\n+\n+Un ACL est une liste de principals associé à une permission sur un\n+objet :\n+\n+::\n+\n+    create_record: alexis,remy,tarek\n+\n+Cet ACL donne la permission ``create`` sur l'objet ``record`` aux\n+utilisateurs ``alexis,remy,tarek``\n+\n+\n+La délégation de permissions\n+============================\n+\n+Un utilisateur peut avoir un certain nombre de droits sur ses données\n+stockées dans le service de stockage. Prenons un exemple :\n+\n+- Ses contacts.\n+- Une liste de tâches à faire qui peut associer à ses contacts.\n+\n+L'utilisateur a tous les droits sur ses données.\n+\n+Cependant il utilise deux apps :\n+\n+- Une application de gestion des contacts a qui il souhaite délèguer\n+  la gestion intégrale de ses contacts : ``contacts:read+write``\n+- Une application de gestion des tâches a qui il souhaite délèguer la\n+  gestion des tâches : ``contacts:read,tasks:read+write``\n+\n+Il souhaite que son application de contacts ne puisse pas accèder à\n+ses tâches et que son application de tâches ne puisse pas modifier ses\n+contacts.\n+\n+Il lui faut donc un moyen de déléguer ses droits en tant\n+qu'utilisateur.\n+\n+C'est précisément le rôle des `scopes OAuth2\n+<http://tools.ietf.org/html/rfc6749#page-23>`_.\n+\n+La difficulté dans notre service de stockage générique étant qu'il est","path":"content/2015.05.cliquet-permissions.rst","position":90,"original_position":90,"commit_id":"20ddd1e7ba1f9d53c2978134e02e1bae510c4225","original_commit_id":"20ddd1e7ba1f9d53c2978134e02e1bae510c4225","user":{"login":"leplatrem","id":546692,"avatar_url":"https://avatars.githubusercontent.com/u/546692?v=3","gravatar_id":"","url":"https://api.github.com/users/leplatrem","html_url":"https://github.com/leplatrem","followers_url":"https://api.github.com/users/leplatrem/followers","following_url":"https://api.github.com/users/leplatrem/following{/other_user}","gists_url":"https://api.github.com/users/leplatrem/gists{/gist_id}","starred_url":"https://api.github.com/users/leplatrem/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/leplatrem/subscriptions","organizations_url":"https://api.github.com/users/leplatrem/orgs","repos_url":"https://api.github.com/users/leplatrem/repos","events_url":"https://api.github.com/users/leplatrem/events{/privacy}","received_events_url":"https://api.github.com/users/leplatrem/received_events","type":"User","site_admin":false},"body":"est ?","created_at":"2015-05-12T13:08:00Z","updated_at":"2015-05-12T13:08:00Z","html_url":"https://github.com/mozilla-services/servicedenuages.fr/pull/21#discussion_r30131027","pull_request_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/pulls/21","_links":{"self":{"href":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/pulls/comments/30131027"},"html":{"href":"https://github.com/mozilla-services/servicedenuages.fr/pull/21#discussion_r30131027"},"pull_request":{"href":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/pulls/21"}}},"pull_request":{"url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/pulls/21","id":35222481,"html_url":"https://github.com/mozilla-services/servicedenuages.fr/pull/21","diff_url":"https://github.com/mozilla-services/servicedenuages.fr/pull/21.diff","patch_url":"https://github.com/mozilla-services/servicedenuages.fr/pull/21.patch","issue_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/issues/21","number":21,"state":"open","locked":false,"title":"De la gestion des permissions.","user":{"login":"Natim","id":229453,"avatar_url":"https://avatars.githubusercontent.com/u/229453?v=3","gravatar_id":"","url":"https://api.github.com/users/Natim","html_url":"https://github.com/Natim","followers_url":"https://api.github.com/users/Natim/followers","following_url":"https://api.github.com/users/Natim/following{/other_user}","gists_url":"https://api.github.com/users/Natim/gists{/gist_id}","starred_url":"https://api.github.com/users/Natim/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Natim/subscriptions","organizations_url":"https://api.github.com/users/Natim/orgs","repos_url":"https://api.github.com/users/Natim/repos","events_url":"https://api.github.com/users/Natim/events{/privacy}","received_events_url":"https://api.github.com/users/Natim/received_events","type":"User","site_admin":false},"body":"","created_at":"2015-05-12T12:48:53Z","updated_at":"2015-05-12T13:08:00Z","closed_at":null,"merged_at":null,"merge_commit_sha":"8ba06e2e929ceb9c1039b0007290b2d19b89d289","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/pulls/21/commits","review_comments_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/pulls/21/comments","review_comment_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/pulls/comments{/number}","comments_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/issues/21/comments","statuses_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/statuses/20ddd1e7ba1f9d53c2978134e02e1bae510c4225","head":{"label":"mozilla-services:cliquet-permissions","ref":"cliquet-permissions","sha":"20ddd1e7ba1f9d53c2978134e02e1bae510c4225","user":{"login":"mozilla-services","id":1066228,"avatar_url":"https://avatars.githubusercontent.com/u/1066228?v=3","gravatar_id":"","url":"https://api.github.com/users/mozilla-services","html_url":"https://github.com/mozilla-services","followers_url":"https://api.github.com/users/mozilla-services/followers","following_url":"https://api.github.com/users/mozilla-services/following{/other_user}","gists_url":"https://api.github.com/users/mozilla-services/gists{/gist_id}","starred_url":"https://api.github.com/users/mozilla-services/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mozilla-services/subscriptions","organizations_url":"https://api.github.com/users/mozilla-services/orgs","repos_url":"https://api.github.com/users/mozilla-services/repos","events_url":"https://api.github.com/users/mozilla-services/events{/privacy}","received_events_url":"https://api.github.com/users/mozilla-services/received_events","type":"Organization","site_admin":false},"repo":{"id":34000996,"name":"servicedenuages.fr","full_name":"mozilla-services/servicedenuages.fr","owner":{"login":"mozilla-services","id":1066228,"avatar_url":"https://avatars.githubusercontent.com/u/1066228?v=3","gravatar_id":"","url":"https://api.github.com/users/mozilla-services","html_url":"https://github.com/mozilla-services","followers_url":"https://api.github.com/users/mozilla-services/followers","following_url":"https://api.github.com/users/mozilla-services/following{/other_user}","gists_url":"https://api.github.com/users/mozilla-services/gists{/gist_id}","starred_url":"https://api.github.com/users/mozilla-services/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mozilla-services/subscriptions","organizations_url":"https://api.github.com/users/mozilla-services/orgs","repos_url":"https://api.github.com/users/mozilla-services/repos","events_url":"https://api.github.com/users/mozilla-services/events{/privacy}","received_events_url":"https://api.github.com/users/mozilla-services/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/mozilla-services/servicedenuages.fr","description":"Da french team blog.","fork":false,"url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr","forks_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/forks","keys_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/keys{/key_id}","collaborators_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/teams","hooks_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/hooks","issue_events_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/issues/events{/number}","events_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/events","assignees_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/assignees{/user}","branches_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/branches{/branch}","tags_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/tags","blobs_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/git/refs{/sha}","trees_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/git/trees{/sha}","statuses_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/statuses/{sha}","languages_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/languages","stargazers_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/stargazers","contributors_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/contributors","subscribers_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/subscribers","subscription_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/subscription","commits_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/commits{/sha}","git_commits_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/git/commits{/sha}","comments_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/comments{/number}","issue_comment_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/issues/comments{/number}","contents_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/contents/{+path}","compare_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/compare/{base}...{head}","merges_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/merges","archive_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/downloads","issues_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/issues{/number}","pulls_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/pulls{/number}","milestones_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/milestones{/number}","notifications_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/labels{/name}","releases_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/releases{/id}","created_at":"2015-04-15T15:07:57Z","updated_at":"2015-05-07T18:54:27Z","pushed_at":"2015-05-12T12:48:54Z","git_url":"git://github.com/mozilla-services/servicedenuages.fr.git","ssh_url":"git@github.com:mozilla-services/servicedenuages.fr.git","clone_url":"https://github.com/mozilla-services/servicedenuages.fr.git","svn_url":"https://github.com/mozilla-services/servicedenuages.fr","homepage":"http://www.servicedenuages.fr","size":2365,"stargazers_count":1,"watchers_count":1,"language":"HTML","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":1,"mirror_url":null,"open_issues_count":4,"forks":1,"open_issues":4,"watchers":1,"default_branch":"master"}},"base":{"label":"mozilla-services:master","ref":"master","sha":"3fc0bcf896797a076c2e1aa308da0ced1fe0af34","user":{"login":"mozilla-services","id":1066228,"avatar_url":"https://avatars.githubusercontent.com/u/1066228?v=3","gravatar_id":"","url":"https://api.github.com/users/mozilla-services","html_url":"https://github.com/mozilla-services","followers_url":"https://api.github.com/users/mozilla-services/followers","following_url":"https://api.github.com/users/mozilla-services/following{/other_user}","gists_url":"https://api.github.com/users/mozilla-services/gists{/gist_id}","starred_url":"https://api.github.com/users/mozilla-services/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mozilla-services/subscriptions","organizations_url":"https://api.github.com/users/mozilla-services/orgs","repos_url":"https://api.github.com/users/mozilla-services/repos","events_url":"https://api.github.com/users/mozilla-services/events{/privacy}","received_events_url":"https://api.github.com/users/mozilla-services/received_events","type":"Organization","site_admin":false},"repo":{"id":34000996,"name":"servicedenuages.fr","full_name":"mozilla-services/servicedenuages.fr","owner":{"login":"mozilla-services","id":1066228,"avatar_url":"https://avatars.githubusercontent.com/u/1066228?v=3","gravatar_id":"","url":"https://api.github.com/users/mozilla-services","html_url":"https://github.com/mozilla-services","followers_url":"https://api.github.com/users/mozilla-services/followers","following_url":"https://api.github.com/users/mozilla-services/following{/other_user}","gists_url":"https://api.github.com/users/mozilla-services/gists{/gist_id}","starred_url":"https://api.github.com/users/mozilla-services/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mozilla-services/subscriptions","organizations_url":"https://api.github.com/users/mozilla-services/orgs","repos_url":"https://api.github.com/users/mozilla-services/repos","events_url":"https://api.github.com/users/mozilla-services/events{/privacy}","received_events_url":"https://api.github.com/users/mozilla-services/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/mozilla-services/servicedenuages.fr","description":"Da french team blog.","fork":false,"url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr","forks_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/forks","keys_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/keys{/key_id}","collaborators_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/teams","hooks_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/hooks","issue_events_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/issues/events{/number}","events_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/events","assignees_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/assignees{/user}","branches_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/branches{/branch}","tags_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/tags","blobs_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/git/refs{/sha}","trees_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/git/trees{/sha}","statuses_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/statuses/{sha}","languages_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/languages","stargazers_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/stargazers","contributors_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/contributors","subscribers_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/subscribers","subscription_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/subscription","commits_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/commits{/sha}","git_commits_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/git/commits{/sha}","comments_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/comments{/number}","issue_comment_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/issues/comments{/number}","contents_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/contents/{+path}","compare_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/compare/{base}...{head}","merges_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/merges","archive_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/downloads","issues_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/issues{/number}","pulls_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/pulls{/number}","milestones_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/milestones{/number}","notifications_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/labels{/name}","releases_url":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/releases{/id}","created_at":"2015-04-15T15:07:57Z","updated_at":"2015-05-07T18:54:27Z","pushed_at":"2015-05-12T12:48:54Z","git_url":"git://github.com/mozilla-services/servicedenuages.fr.git","ssh_url":"git@github.com:mozilla-services/servicedenuages.fr.git","clone_url":"https://github.com/mozilla-services/servicedenuages.fr.git","svn_url":"https://github.com/mozilla-services/servicedenuages.fr","homepage":"http://www.servicedenuages.fr","size":2365,"stargazers_count":1,"watchers_count":1,"language":"HTML","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":1,"mirror_url":null,"open_issues_count":4,"forks":1,"open_issues":4,"watchers":1,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/pulls/21"},"html":{"href":"https://github.com/mozilla-services/servicedenuages.fr/pull/21"},"issue":{"href":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/issues/21"},"comments":{"href":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/issues/21/comments"},"review_comments":{"href":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/pulls/21/comments"},"review_comment":{"href":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/pulls/21/commits"},"statuses":{"href":"https://api.github.com/repos/mozilla-services/servicedenuages.fr/statuses/20ddd1e7ba1f9d53c2978134e02e1bae510c4225"}}}}