Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Make security guides more readable #275

Merged
merged 11 commits into from
Apr 10, 2019
Merged

Conversation

scottinet
Copy link
Contributor

@scottinet scottinet commented Apr 5, 2019

⚠️ depends on #274

Description

  1. The security guide features examples using Javascript code instead of plain JSON objects, and this was confusing for our readers
  2. Make the security guide examples clearer
  3. Wrap the very, very long curl example to prevent an impractical horizontal scrollbar from appearing (the example still works after having been copy-pasted, obviously)

How to test

Go to the following pages in the netlify preview:

Note

There is a handlebar pattern that is not interpreted at the bottom of the security guide (this is already the case in production).
I don't have much time to spend on that, but AFAIK it seems that handlebars helpers returning a safestring prevent automatic field interpolation appearing later on the same line. To be investigated.

Fixed two of those actually. The problem is that, for still unknown reasons, using a handlebars safestring disables further markdown interpretation. So, until we understand what's going on, I used HTML instead of markdown.

@scottinet scottinet self-assigned this Apr 5, 2019
@kuzzle
Copy link
Contributor

kuzzle commented Apr 5, 2019

Snippets tests reports

SDK Version Tests overview
v6 ✔️
v5 ✔️
v1 ✔️
v1 ✔️
v1 ✔️
v1 ✔️

}
}
}
};
}
```
Copy link

@ballinette ballinette Apr 9, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My comment is about the unchanged text below:

The `action permission` value can be set to either:
- a boolean. If `true`, the `role` allows the given action.
- an object describing a dynamic right definition. For more information check out the [advanced roles documentation]({{ site_base_path }}guide/1/kuzzle-depth/roles-definitions)).

As the closures are deprecated, do we really want to reference it here ?
Or at least add a deprecated tag to the line an object describing a dynamic right definition.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I added a deprecated tag, because a documentation must be exhaustive, even if it means giving out of date details.

<another role>,
...
{
"roleId": "<another role identifier>"
Copy link

@ballinette ballinette Apr 9, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nitpicking: I would put the example without restriction at the first place (to read the policies from the simplest form to the most complex one)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agreed. I also applied this remark to the restrictedTo example.

* users with `profile3` are only allowed to use `document` controller actions on:
* all collections stored in index `index2`
* collections `foo` and `bar` stored in index `index1`.

---

## Writing complex permission rules

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

About the last (unchanged) sentence There are multiple ways of adding a business logic layer on top of the standard Kuzzle security one:, I would reorder the items, and put:

  1. write a pipe plugin
  2. use document validators
  3. use closures (deprecated)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Makes more sense that way 👍

@etrousset etrousset merged commit d9dbbce into master Apr 10, 2019
@etrousset etrousset deleted the make-security-guide-readable branch April 10, 2019 13:17
Aschen added a commit that referenced this pull request May 29, 2019
@Aschen Aschen mentioned this pull request May 29, 2019
Aschen added a commit that referenced this pull request May 29, 2019
This was referenced Jun 12, 2019
xbill82 added a commit that referenced this pull request Jun 13, 2019
# [3.0.0](https://github.com/kuzzleio/documentation/releases/tag/3.0.0) (2019-06-12)


#### Bug fixes

- [ [#298](#298) ] Fix bulk import return   ([Aschen](https://github.com/Aschen))
- [ [#325](#325) ] Adapt legacy redirection   ([Aschen](https://github.com/Aschen))
- [ [#322](#322) ] Fix remaining dead links and add check_link to CI   ([Aschen](https://github.com/Aschen))
- [ [#304](#304) ] Fix sdk js tests   ([benoitvidis](https://github.com/benoitvidis))

#### New features

- [ [#299](#299) ] Documentation for wildcard events   ([thomasarbona](https://github.com/thomasarbona))
- [ [#321](#321) ] Add guide about secrets management with the Vault   ([Aschen](https://github.com/Aschen))
- [ [#300](#300) ] Add page about bulk:write and bulk:mwrite   ([Aschen](https://github.com/Aschen))

#### Enhancements

- [ [#327](#327) ] SPA mode   ([xbill82](https://github.com/xbill82))
- [ [#324](#324) ] Update Redis version   ([Aschen](https://github.com/Aschen))
- [ [#316](#316) ] Sdks authenticated connected props   ([Aschen](https://github.com/Aschen))
- [ [#317](#317) ] Add new way for updateSpecifications & validateSpecifications   ([thomasarbona](https://github.com/thomasarbona))
- [ [#296](#296) ] Rewrite the Realtime guide   ([Aschen](https://github.com/Aschen))
- [ [#301](#301) ] Deprecate realtime join   ([Aschen](https://github.com/Aschen))
- [ [#291](#291) ] Getting started React + improve snippetManager   ([thomasarbona](https://github.com/thomasarbona))
- [ [#294](#294) ] Add s3 plugin   ([Aschen](https://github.com/Aschen))
- [ [#292](#292) ] Add since   ([Aschen](https://github.com/Aschen))
- [ [#276](#276) ] [KZL-907] Getting started dev plugin   ([Yoann-Abbes](https://github.com/Yoann-Abbes))
- [ [#284](#284) ] Extending the JS SDK with controllers   ([Aschen](https://github.com/Aschen))
- [ [#271](#271) ] Add documentation page about mappings   ([Aschen](https://github.com/Aschen))

#### Others

- [ [#314](#314) ] Add a clustering guide   ([scottinet](https://github.com/scottinet))
- [ [#319](#319) ] Getting-started-sdk-JS6-architecture   ([berthieresteban](https://github.com/berthieresteban))
- [ [#311](#311) ] Add PDF sending example for Request.setResult   ([Aschen](https://github.com/Aschen))
- [ [#315](#315) ] Normalize directories and generate redirections   ([Aschen](https://github.com/Aschen))
- [ [#309](#309) ] Port #284 to 3-dev   ([berthieresteban](https://github.com/berthieresteban))
- [ [#308](#308) ] Port #283 to 3-dev   ([berthieresteban](https://github.com/berthieresteban))
- [ [#307](#307) ] Port #282 to 3-dev   ([berthieresteban](https://github.com/berthieresteban))
- [ [#306](#306) ] Port #280 to 3-dev   ([berthieresteban](https://github.com/berthieresteban))
- [ [#312](#312) ] Port 278 to 3-dev   ([Aschen](https://github.com/Aschen))
- [ [#310](#310) ] Port #277 to 3-dev   ([Aschen](https://github.com/Aschen))
- [ [#305](#305) ] Port #275 to 3-dev   ([Aschen](https://github.com/Aschen))
- [ [#303](#303) ] Port #274 to 3-dev   ([Aschen](https://github.com/Aschen))
- [ [#302](#302) ] Port #271 to 3-dev   ([Aschen](https://github.com/Aschen))
- [ [#313](#313) ] Port #266 to 3-dev   ([Yoann-Abbes](https://github.com/Yoann-Abbes))
- [ [#290](#290) ] [KZL-1050] Role template example in the documentation   ([Yoann-Abbes](https://github.com/Yoann-Abbes))
- [ [#293](#293) ] [KZL-1036] Add available plugins   ([Yoann-Abbes](https://github.com/Yoann-Abbes))
- [ [#286](#286) ] Embedded protocols   ([benoitvidis](https://github.com/benoitvidis))
---
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants