Finer grained permissions

[Natim]

Today, when we give the collection:write permission it implies the right to share this collection to anyone.

When you are logging in some application, you might want to refrain it to share your data.

A good way to do that is to explicitly ask for permission using scopes.

My proposal is to not give any permission with the kinto scope but to only allow permission to what defines in the scope:

• todo:tasks:write
• todo:tasks:permission
• todo:tasks:schema

[leplatrem]

Use-case exposed by @almet and @Natim :

A collection has a schema. A formbuilder needs to read that schema to render the form. In order to read that collection object, we currently need to set read on the collection, which also gives the permissions to read every records! If the form is a poll for example, we only want to give record:create, but certainly not the permission to read every record.

Workaround: use two collections: one for the schema, one for the records.

[Natim]

Workaround: use two collections: one for the schema, one for the records.

This means that you need to create a collection with a JSONSchema validator to validate that the schema you enter in the form list is valid.