View Issue Details

Jump to NotesJump to History
IDProjectCategoryView StatusDate SubmittedLast Update
0009647Talermerchant backendpublic2025-03-22 12:462025-08-31 17:09
Reporterschanzen Assigned Toschanzen Resolution deadline
ImplementerReviewer 
Release signed byDeployed by 
VerifierCommunicator 
Data protection authority notification requiredNo  
CSIRT notification requiredNo  
Estimated effort (hours)Actual effort (hours)0 
Fast-trackNo
Work packagenone
PrioritynormalSeverityfeatureReproducibilityhave not tried
Status closedResolutionfixed 
Product Version1.0 
Target Version1.0 stretch goalsFixed in Version1.0 stretch goals 
Summary0009647: Scope in tokens / authorizations needs rework
DescriptionThe code calls scopes and that DD49 and the API call scopes are two different things, apparently

For example, through the API you can request "readonly" and "readwrite". But "readwrite" does not exist in the authorization scope enum. It instead maps to the ALL enum. And it is unclear to me if that all includes the REFRESHABLE enum. which is not requestable at all through the API

From mattermost:

READONLY == GET-only in the enum.

RW indeed is currently 'ALL'.

But overall, as I said, the scopes need a (re)design.


I'm fine with keeping 'READ-ONLY = GET-ONLY' and we obviously need 'everything' (= password login, also SPA) including refreshable.

Then we need smaller ones: (1) order-creation-and-payment-status-check-only (ORDER-SIMPLE?), (2) order-creation-and-inventory-locking (ORDER-POS, includes ORDER-SIMPLE), (3) order-creation-and-refund (ORDER-MGMT, includes ORDER-SIMPLE), (4) ORDER-FULL (ORDER-POS + ORDER-MGMT)


The existing ALL includes refreshable.

But it might make sense to separate RERESHABLE, so we have ALL:REFRESHABLE, ORDER-SIMPLE:REFRESHABLE, etc.


And READ-ONLY:REFRESHABLE.

WooCommerce might get something like ORDER-MGMT (non-refreshable, but no expiration), the PoS-App would get tokens of type ORDER-POS (with or without refreshable, user can set a checkbox and/or specify validity period upon creation).


A staff member responsible for refunds might get ORDER-FULL or ORDER-MGMT, etc.
Tagssecurity

Required notifications

Address or linkRemarkAdded byNotifiedActions

The plan

IDSummaryStatusAssigned ToEstimated effort (hours)
0009556address merchant auth token weirdness closedChristian Grothoff
0009620Restrict public instance access and replace token-based authentication with username and password closedschanzen
This issue (hours)
Its children (hours)0
Together (hours)0
Nothing is missing: the plan can be finished.

Relationships

parent of 0009556 closedChristian Grothoff address merchant auth token weirdness 
parent of 0009620 closedschanzen Restrict public instance access and replace token-based authentication with username and password 

Activities

There are no notes attached to this issue.

Issue History

Date ModifiedUsernameFieldChange
2025-03-22 12:46schanzenNew Issue
2025-03-22 12:46schanzenStatusnew => assigned
2025-03-22 12:46schanzenAssigned To => Christian Grothoff
2025-03-22 12:56Christian GrothoffAssigned ToChristian Grothoff => schanzen
2025-03-22 12:56Christian GrothoffSeverityminor => feature
2025-03-22 13:09Christian GrothoffCategorymechant backend => merchant backend
2025-03-22 14:42schanzenSummaryScope in tokens / authoriyations needs rework => Scope in tokens / authorizations needs rework
2025-03-23 18:42schanzenRelationship addedrelated to 0009556
2025-04-17 20:36Christian GrothoffTag Attached: security
2025-05-08 13:35Christian GrothoffRelationship replacedparent of 0009556
2025-05-08 20:20Christian GrothoffRelationship addedparent of 0009620
2025-06-21 20:32schanzenStatusassigned => informing
2025-06-21 20:32schanzenResolutionopen => fixed
2025-06-21 22:08Christian GrothoffProduct Version => 1.0
2025-06-21 22:08Christian GrothoffFixed in Version => 1.0 stretch goals
2025-06-21 22:08Christian GrothoffTarget Version1.1 => 1.0 stretch goals
2025-08-31 17:09Christian GrothoffStatusinforming => closed
Powered by locust
Contact administrator for assistance
User Documentation