Scope special case for privilege sets about oauth2 HOT 3 CLOSED

Thanks Daniel but to be honest a great coder and colleague of mine @mtornwall is the original author of that module. Anyway I think you're reading it backwards. You should think of it as A ⊆ B such as {root, a} ⊆ {root, a, b}. That is A is a subset with same or fewer elements than B for the function oauth2_priv_set:is_subset(A, B).

from oauth2.

Hi @drobakowski! This behavior is the result of a (perhaps unfortunate) design decision early on. Basically, when testing if A is a subset of B we check if all paths in A are also in B. In your first example the path root-a is indeed present in B. This has been the source of much confusion. The idea is that you shouldn't associate any privileges with non-leaf nodes, like root.a.

I am typing this up on my tablet so I had to be brief. If you have more questions I will try and answer them from a real computer. :)

from oauth2.

Hi @bipthelin, hi @mtornwall! Thanks for your quick and detailed response! The behavior and idea of priv_set is now clear to me. My focus was to strong on our own privilege scenario, where we have to restrict the privileges only with leaf nodes and not to every possible path of the tree. With a set in mind the methods is_subset/is_member work as expected. :) For now we'll evaluate and work with our internal priv_set implementation, thanks again for the detailed description!

from oauth2.