DACO role management proposal - #6
Conversation
First draft of DACO role management proposal
daisieh
left a comment
daisieh
left a comment
There was a problem hiding this comment.
I think this tracks with what we agreed on.
| * **Submission**: when registering a Study in authz, include the `dac_id` in the POST body. If the DAC for a Study changes, update | ||
| the authz study registration accordingly. | ||
| * **Authz** : creates a specific API path for data access requests for a user (user in this case = the data access applicant): | ||
| `/user/<id>/access_approval/<study_id>` |
There was a problem hiding this comment.
The POST could include the study id in the body of the request, along with start and end dates, instead of having it in the url.
There was a problem hiding this comment.
Some questions about this:
First, is this going to be a new endpoint? if yes,
- what is
<id>in this endpoint? email or PCGLID? - what would be the API to remove dac authorizations.
Currently as per authz docs there are 2 endpoints to grant DAC authorizations and 1 to delete
- POST /study/{studyId} - body: email address, start/end date.
- POST /user/{userId} - body: studyId, start/end date
- DELETE /user{userId}/study/{studyId}
these endpoints are very useful from DACO, would be a chance to reuse those? allowing only if bearer token belongs to a DAC chair of that specific study?
There was a problem hiding this comment.
Those are the endpoints we're talking about, but I think that we'd change the user POST to include /access_approval to make it more clear that it is only the user's access to a study that is being changed.
| DACO can call the authz `/allowed` endpoint with the following body: | ||
|
|
||
| ``` | ||
| path: /user/<id>/access_approval/ |
There was a problem hiding this comment.
| path: /user/<id>/access_approval/ | |
| path: /user/<id>/allowed |
There was a problem hiding this comment.
I don't like this because it doesn't specify what the user is allowed to do...
3 participants
First draft of a DACO role management proposal that (once implemented) will address Pan-Canadian-Genome-Library/pcgl-authz#80
Pinging @joneubank @lindaxiang @edsu7 @leoraba for feedback, as this affects DACO and Submission.