[Girder-users] Restricting user access

[Zach Mullen]

Hi Andy,

Both of these things are pretty easy. API endpoints can be removed in your
plugin just by using delattr on the method itself under info['apiRoot'].
Modifying the UI to only show login for admins is pretty simple, too, by
using the wrap function on the HeaderUserView.render function.

Thanks,



Zach Mullen
Kitware, Inc.
919-869-8858

On Mon, Jul 3, 2017 at 3:23 PM, Andrés Fortier <andres at ekumenlabs.com>
wrote:

> Hi all,
> I was wondering if it is possible to restrict a user access to girder,
> both in the REST API and in the web view. One use case for this is to be
> able to treat a folder and its contents as a whole: we want a user to be
> able to upload a folder and to update it, but always as a whole (i.e. not
> to allow partial updates, like adding a file to it). Our idea would be to
> have a dedicated REST endpoint for this (similar to the way a folder is
> uploaded now) to handle the CRUD, but then we need to ensure that:
>
> 1. the user can't manually call the current API to update the folder. I
> think the way to do this would be to remove some API endpoints, although
> I'm not sure this can be done easily.
> 2. the user can't login in the web UI (this is ok as we will be rolling
> our dedicated UI). Is there a simple way to make the UI admin-only?
>
> Any hints would be much appreciated.
>
> Thanks!
> Andy
>
> _______________________________________________
> Girder-users mailing list
> Girder-users at public.kitware.com
> http://public.kitware.com/mailman/listinfo/girder-users
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://public.kitware.com/pipermail/girder-users/attachments/20170703/3638b6cc/attachment.html>