[jira] [Commented] (TC-461) Delivery-service tenancy based access control - Steering Target

["ASF GitHub Bot (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/TC-461?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16113334#comment-16113334 ] 

ASF GitHub Bot commented on TC-461:
-----------------------------------

Github user mitchell852 commented on a diff in the pull request:

    https://github.com/apache/incubator-trafficcontrol/pull/766#discussion_r131236009
  
    --- Diff: traffic_ops/app/lib/API/DeliveryService/SteeringTarget.pm ---
    @@ -29,6 +30,20 @@ sub index {
     	my $steering_id = $self->param('id');
     	my @data;
     
    +	my $tenant_utils = Utils::Tenant->new($self);
    +	my $tenants_data = $tenant_utils->create_tenants_data_from_db();
    +	my $ds = $self->db->resultset('Deliveryservice')->find( { id => $steering_id } );
    +	if ( defined($ds) ) {
    +		#TO THE REVIEWER
    --- End diff --
    
    can you take out the "to the reviewer"s


> Delivery-service tenancy based access control - Steering Target
> ---------------------------------------------------------------
>
>                 Key: TC-461
>                 URL: https://issues.apache.org/jira/browse/TC-461
>             Project: Traffic Control
>          Issue Type: Improvement
>          Components: Traffic Ops
>            Reporter: Nir Sopher
>
> We have recently added "tenancy" to the project. 
> With tenancy, every resource have a tenant, where resource can be a delivery-service, a server (future) and even a user.
> We are now starting to enforce access-control based on the resource tenancy. A user can manage a resource only if the resource is under the user tenancy.
> This JIRA deals with another step of "delivery-service as a resource" - enforcing via the API access control on DS steering target: In order to add a steering target DS1 to steering DS ST1, the user should have access to the tenants of DS1 and ST1. In order to read the record, access to ST1 is enough 



--
This message was sent by Atlassian JIRA
(v6.4.14#64029)