JWT token scope extended to a playlist instead of a resource #2286
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
See #1342 and #2249
Purpose
The JWT token used in the application (the LTI one) is only focused on a resource (a video or a document). We would like to extend this scope to a playlist. If you can access a resource in a playlist, then you should also have the right to access the other resources in the same playlist.
Proposal
Create a new token focused on playlist access, and a new
IsTokenPlaylistRouteObject
permission verifying the user has access to a playlist incore.permissions
.Replace
IsTokenResourceRouteObject
andIsTokenResourceRouteObjectRelated___
occurences by the newIsTokenPlaylistRouteObject
in the API in :VideoViewSet
ClassroomViewSet
DocumentViewSet
FileDepositoryViewSet
MarkdownDocumentViewSet
For
IsTokenResourceRouteObject
And :
TimedTextTrackViewSet
LiveSessionViewSet
SharedLiveMediaViewSet
ThumbnailViewSet
class ClassroomDocumentViewSet
For
IsTokenResourceRouteObjectRelated___