{"action":"opened","issue":{"url":"https://api.github.com/repos/eventespresso/eea-rest-api/issues/8","labels_url":"https://api.github.com/repos/eventespresso/eea-rest-api/issues/8/labels{/name}","comments_url":"https://api.github.com/repos/eventespresso/eea-rest-api/issues/8/comments","events_url":"https://api.github.com/repos/eventespresso/eea-rest-api/issues/8/events","html_url":"https://github.com/eventespresso/eea-rest-api/issues/8","id":66032533,"number":8,"title":"Apply permissions/caps to the API","user":{"login":"mnelson4","id":1766382,"avatar_url":"https://avatars.githubusercontent.com/u/1766382?v=3","gravatar_id":"","url":"https://api.github.com/users/mnelson4","html_url":"https://github.com/mnelson4","followers_url":"https://api.github.com/users/mnelson4/followers","following_url":"https://api.github.com/users/mnelson4/following{/other_user}","gists_url":"https://api.github.com/users/mnelson4/gists{/gist_id}","starred_url":"https://api.github.com/users/mnelson4/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mnelson4/subscriptions","organizations_url":"https://api.github.com/users/mnelson4/orgs","repos_url":"https://api.github.com/users/mnelson4/repos","events_url":"https://api.github.com/users/mnelson4/events{/privacy}","received_events_url":"https://api.github.com/users/mnelson4/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-04-02T23:35:36Z","updated_at":"2015-04-02T23:35:36Z","closed_at":null,"body":"permissions should be take into account when:\r\n-determining if the current user can access an endpoint at ALL \r\n-determining if the current user can GET a particular entity after it's been retrieved from the DB (ie a request to events/1 should return 403 if it exists but the current user can't access it; not just a 404 saying it wasn't found)\r\n-building database queries\r\n-determining which fields should be returned even if the current user has permission to see an item\r\n-determining if the current user can create new items\r\n-determining if the current user can update a specific item\r\n-determining if the current user can update a particular FIELD? I think generally if you can create or update an item, you can create/update ALL of it that's writeable (ie, there are still some fields which are read-only over the API, because we want the API/models to take care of calculating its value and don't want to burden API clients with its calculation, eg TXN_total)"}}