Design & Architecture: a share is an anonymous way to login

[EdouardVanbelle]

Hello with the ReBAC model recently added, I am working on the fusion with ReBAC and current Share (the legacy)

I am exporing this way: a Share (aka a Token) is a way to authenticate to the system, that will open dors to browse

Subject::User(uuid) → authenticated via JWT
Subject::Token(uuid) → authenticated via share token (which can request a password)

In the future I will add something like:
Subject::External(uuid | email) -> authenticate via email challenge or via self issued OIDC

For security reasons I consider that an Token (anonymous) will always have Readonly permission, if you want write access then Subject::External can help you, that will facilitate audit/logs too

If any though, feel free
cc @DioCrafts

That will simplify the API /api/s/... (currently there are duplicates with /api/folders/...)
It will also ease the usage of 1 uniq component (ResourceListComponent) to display files and folders

cc @abnvle it may change your proxy (it will be harder to isolate shares vs classic users)
Eventually a simple check on the Auth way can solve this case

[abnvle]

Hi,
Thanks for the information :)