AdminList AuthZ Plugin: Read-Only vs. Full Admin

[bobvanluijt]

Currently, authentication gives all-or-nothing access. Preferably admins can set read, write or read/write for users of a single Weaviate instance.

[etiennedi]

We can extend the current AdminList Authorization plugin with a read-only list. Then we have an admin list, and a read-only list. This would still fit the current design and wouldn't be too much effort to implement.

Once we want to go more fine grained than that we should go the full RBAC Route as outlined in #802, but I don't think we need that yet for this simple split between Admin and ReadOnly.

Minor remark to

Preferably admins can set read, write or read/write

Writing always implies reading permissions as well (because of validation and getting back the result you just wrote, etc), so I think the most sensible split would be Admin (i.e. all permissions including write and delete) vs. Read-Only (containing only get and list).

[etiennedi]

Todos

• extend admin list with read only list
• at startup make sure no subject is contained in both lists
• at authorize time
  • if not member of admin list check if verb is get or list, then check if user is on read-only list
• update documentation
• release