[ADDED] Account default permissions #1398
Conversation
server/accounts.go
Outdated
| if p == nil && acc.default_perms != nil { | ||
| json, _ := json.Marshal(*acc.default_perms) | ||
| log.Printf("apply default_perms %+v to %s\n", string(json), uc.Subject) | ||
| p = acc.default_perms |
There was a problem hiding this comment.
We have to ask ourselves: would there be a case where we alter this user's permissions after that. If so, that would change the account's default user. It exists a Permissions.clone() that makes a copy of permissions. If need be, we may need to use that here.
There was a problem hiding this comment.
I went back and forth on this. Maybe it's safest to clone them
There was a problem hiding this comment.
@kozlovic the reason for not calling clone was that auth.defaultPermissions was not cloned either. Change it for both I assume?
There was a problem hiding this comment.
I would clone, unless we are sure they will never be altered (I mean at the user-level, consequently altering the default values).
There was a problem hiding this comment.
A precision to that: if we start to have lots and lots of users, and we are sure that if there are default perms we don't alter them, then we could save mem allocs. So I guess it is more a question of ensuring that if a user uses default perms, then we never ever modify them. Or if we have to, then that's when we do a clone.
There was a problem hiding this comment.
@kozlovic I noticed that when user are copied from options to the server, their permissions are cloned. This is why I don't call clone in that code. However when generating an nkey user on the fly I did add clone to arrive at the same data structure as when configured.
matthiashanel
force-pushed
the
account_default_perms
branch
from
5908213
to
3079b94
Compare
Signed-off-by: Matthias Hanel <mh@synadia.com>
matthiashanel
force-pushed
the
account_default_perms
branch
from
3079b94
to
cf6fcda
Compare
Signed-off-by: Matthias Hanel <mh@synadia.com>
Adding default permissions to account (config and jwt).
This simplifies config of the common user.
This happens in the authorization block already.
This change corresponds to nats-io/jwt#75