Proposed change to RT::Principal::HasRight

RT Developers
1

Principal::HasRight will return true regardless of the user
has been granted the right directly (ACLEquivalence), as
part of a group (UserDefined), or as part of a few
other group Domains.

I would like to be able to ask RT if a user has the right
directly or as being part of a group.

It’s a simple patch to give HasRight a Domain list reference
option that default to the currently implemented functionality.

Is there a better way to do this or should I write, test, and
submit a patch?

-Todd

2

Is there a better way to do this or should I write, test, and
submit a patch?

Start with a test script showing the proposed API?
The idea basically sounds sane. Nice work on the new rights matix, by
the way. That might do well as an RTx that users can install from CPAN…

Jesse

3

Is there a better way to do this or should I write, test, and
submit a patch?

Start with a test script showing the proposed API?
The idea basically sounds sane. Nice work on the new rights matix, by
the way. That might do well as an RTx that users can install from CPAN…

Thanks!

The matrix is being updated now to support editing rights too. The change
to HasRight is needed to keep people from trying to revoke rights on
a user who only has that right by virture of belonging to a UserDefined
group or similar.

Do you think CPAN really appropriate? I only ask because there are
no libs to install.

4

Do you think CPAN really appropriate? I only ask because there are
no libs to install.

Yes. You’ll want at least one small lib to stick a version in. And I bet
you’ll end up with some neat functions to get rights, sets of rights and
so on :wink:

5

Principal::HasRight will return true regardless of the user
has been granted the right directly (ACLEquivalence), as
part of a group (UserDefined), or as part of a few
other group Domains.

I would like to be able to ask RT if a user has the right
directly or as being part of a group.

It’s a simple patch to give HasRight a Domain list reference
option that default to the currently implemented functionality.

Is there a better way to do this or should I write, test, and
submit a patch?
Very bad idea, this sub is perfomance bottleneck and must be
simplified instead of adding new functionality into it. You can scan
groups for rights or do whatever magic you want, but don’t touch this
unless it has real bugs.

-Todd

Rt-devel mailing list
Rt-devel@lists.bestpractical.com
The rt-devel Archives

Best regards, Ruslan.

6

Principal::HasRight will return true regardless of the user
has been granted the right directly (ACLEquivalence), as
part of a group (UserDefined), or as part of a few
other group Domains.

I would like to be able to ask RT if a user has the right
directly or as being part of a group.

It’s a simple patch to give HasRight a Domain list reference
option that default to the currently implemented functionality.

Is there a better way to do this or should I write, test, and
submit a patch?
Very bad idea, this sub is perfomance bottleneck and must be
simplified instead of adding new functionality into it. You can scan
groups for rights or do whatever magic you want, but don’t touch this
unless it has real bugs.

I don’t think you understand what I am proposing. If HasRight is changed
as suggested it will run the same if the new option is default. If the
new option is specified, the query will be smaller and faster.

-Todd

7

Is there a better way to do this or should I write, test, and
submit a patch?

Start with a test script showing the proposed API?

Is this what you mean, or something more?

check if user has right based on group membership

if $principal->HasRight(Right => ‘ShowTicket’, Object => $queue,
Domain => [ ‘UserDefined’ ] );

check if user has right directly

if $principal->HasRight(Right => ‘ShowTicket’, Object => $queue,
Domain => [ ‘ACLEquivalence’ ] );

8

Principal::HasRight will return true regardless of the user
has been granted the right directly (ACLEquivalence), as
part of a group (UserDefined), or as part of a few
other group Domains.

I would like to be able to ask RT if a user has the right
directly or as being part of a group.

It’s a simple patch to give HasRight a Domain list reference
option that default to the currently implemented functionality.

Is there a better way to do this or should I write, test, and
submit a patch?
Very bad idea, this sub is perfomance bottleneck and must be
simplified instead of adding new functionality into it. You can scan
groups for rights or do whatever magic you want, but don’t touch this
unless it has real bugs.

I don’t think you understand what I am proposing. If HasRight is changed
as suggested it will run the same if the new option is default. If the
new option is specified, the query will be smaller and faster.
Heh, really didn’t understand you right.

-Todd

Rt-devel mailing list
Rt-devel@lists.bestpractical.com
The rt-devel Archives

Best regards, Ruslan.