Kinto / kinto-signer

Digital signatures to guarantee integrity and authenticity of collections of records.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

If review is disabled for a collection, should we copy the records to the preview bucket?

leplatrem opened this issue · comments

with this in config:

kinto.signer.group_check_enabled = true
kinto.signer.to_review_enabled = true

kinto.signer.resources =
    /buckets/stage -> /buckets/preview -> /buckets/prod

kinto.signer.stage.toto.to_review_enabled = false
kinto.signer.stage.toto.group_check_enabled = false
➜  kinto-signer git:(master) ✗ echo '{"data": {"status": "to-sign"}}' | http PATCH :8888/v1/buckets/stage/collections/toto -a no:no
HTTP/1.1 200 OK
Access-Control-Expose-Headers: Backoff, Content-Length, Retry-After, Alert
Content-Length: 384
Content-Type: application/json
Date: Tue, 13 Nov 2018 22:03:58 GMT
Etag: "1542146638056"
Last-Modified: Tue, 13 Nov 2018 22:03:58 GMT
Server: waitress
X-Content-Type-Options: nosniff

{
    "data": {
        "id": "toto",
        "last_edit_by": "basicauth:0d24c6a44bc65723ecc37e40e19fcc4c935d31ea427bf9b2e8f4c51675d3f81c",
        "last_edit_date": "2018-11-13T22:03:48.850163+00:00",
        "last_modified": 1542146638056,
        "status": "to-sign"
    },
    "permissions": {
        "write": [
            "/buckets/stage/groups/reviewers",
            "basicauth:0d24c6a44bc65723ecc37e40e19fcc4c935d31ea427bf9b2e8f4c51675d3f81c",
            "/buckets/stage/groups/editors"
        ]
    }
}

➜  kinto-signer git:(master) ✗ http :8888/v1/buckets/prod/collections/toto/records
HTTP/1.1 200 OK
Access-Control-Expose-Headers: Retry-After, Cache-Control, Pragma, Backoff, Total-Records, Last-Modified, Content-Length, ETag, Expires, Next-Page, Alert
Cache-Control: no-cache, no-store
Content-Length: 162
Content-Type: application/json
Date: Tue, 13 Nov 2018 22:04:32 GMT
Etag: "1542146628849"
Last-Modified: Tue, 13 Nov 2018 22:03:48 GMT
Server: waitress
Total-Records: 2
X-Content-Type-Options: nosniff

{
    "data": [
        {
            "id": "76f9957c-3a50-4f33-ba83-8a7ff1f6513b",
            "last_modified": 1542146628849
        },
        {
            "id": "8d570a9e-e6c9-4bed-8c78-6d62dfe989b5",
            "last_modified": 1542146627754
        }
    ]
}

➜  kinto-signer git:(master) ✗ http :8888/v1/buckets/preview/collections/toto/records
HTTP/1.1 200 OK
Access-Control-Expose-Headers: Retry-After, Cache-Control, Pragma, Backoff, Total-Records, Last-Modified, Content-Length, ETag, Expires, Next-Page, Alert
Cache-Control: no-cache, no-store
Content-Length: 11
Content-Type: application/json
Date: Tue, 13 Nov 2018 22:04:40 GMT
Etag: "1542146624307"
Last-Modified: Tue, 13 Nov 2018 22:03:44 GMT
Server: waitress
Total-Records: 0
X-Content-Type-Options: nosniff

{
    "data": []
}

Should the client issue a {"status": "to-review"} first?

  1. Well, one obvious thing we should aim for is consistency. kinto-signer should either create the collection and copy records into it, or should not create the collection and not copy records into it.

  2. I can't think of any objective reason why we should require the records to be in the preview bucket. In other words, I think this is a UX decision. Do we want to pitch the kinto-signer lifecycle as always having a preview stage, which can sometimes be trivial if review isn't required? Is it confusing if preview collections are sometimes empty? Are there systems that want to consume this data that expect to find it in the preview collections?