[GitHub] [trafficcontrol] mitchell852 edited a comment on issue #3759: deliveryservice_stats should be accessible to readonly users

[GitBox <gi...@apache.org>]

mitchell852 edited a comment on issue #3759: deliveryservice_stats should be accessible to readonly users
URL: https://github.com/apache/trafficcontrol/issues/3759#issuecomment-516012827
 
 
   > Currently, the /deliveryservice_stats endpoint requires permissions of at least the "operator" role.
   
   Actually, I don't think that's true. It currently requires that either:
   
   a. the ds is assigned to the user OR
   b. you have the ops or above role
   
   https://github.com/apache/trafficcontrol/blob/master/traffic_ops/app/lib/Extensions/TrafficStats/API/DeliveryServiceStats.pm#L38
   
   so really, if the ds is assigned to the user, no role is required. 
   
   however, when tenancy was introduced, the ds to user assignment thing was deprecated so really it should have been changed to:
   
   a. the ds is accessible to the user via tenancy OR
   b. you have the ops or above role
   
   also, we used to let your role overrule everything. see `b`. that's no longer true. 2 things should always be checked.
   
   1. do you have the proper role to perform this action? in this case R/O sounds perfect as brennan said
   2. do you have access to this ds via tenancy?

----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
users@infra.apache.org


With regards,
Apache Git Services