permissions: refactor to use flask-principal

[lnielsen]

Refactor the permissions to rely on Flask-Principal instead - a token with extra data {'recid': '1'} could e.g. update the current identity with a Need(value='1', method='recid').

Then a permission check if a specific user or token gives access could look like e.g.:

Permission(Need('recid', '1'), UserNeed(1234)).can()

Issues:
This has to work for both logged in and anonymous users. However, identity-loaded signal is only sent when a user is logged in. Probably Zenodo-AccessRequests can provide an identity_loader which runs after Flask-Security, and which sets the anonymous identity. This way the identity-loaded signal is also sent for anonymous users, and we can use the signal to provide the need for the identity.

[nharraud]

How many secret links are there per user on the current Zenodo? Are some tokens unlimited in time?
If there are too many tokens the loading of the user identity will take a long time.

Also how would it work for search? Are the shared records supposed to appear in the search results?

[lnielsen]

It's rather the other way around… it's only when a user users a link ?token=…., that the need will be set in the current identity. This is because links are not given are not tied to users in anyway. They are just tokens that given you posses the token you can access the given resource.

Hence, it won't cause any loading issues, since you're just loading one token at a time.

Currently in zenodo all records are searchable, so there's no difference. However I don't think it would be difficult to add support for showing hidden records if you have a given token…..

[nharraud]

It's rather the other way around… it's only when a user users a link ?token=…., that the need will be set in the current identity.

Ok I understand better what you want to do. Seems simple enough.

Currently in zenodo all records are searchable, so there's no difference.

Ah yes you are right, I forgot that only the files are hidden. No problem on this side then. And yes for those who need to index the tokens in the records, they could use the request_accepted signal.