Federated permissions in Vervis

I’m about to implement web-based merging of Merge Requests. But how to determine whether a given remote user has access to do this, for a given local repo? How to do Object Capabilities on the Fediverse? This is still being examined. Until the working groups come up with a plan, I’m implementing a very very simple temporary mechanism:

  • To grant access, send a Grant activity where object is a URI referring to a role (there’s no AP representation for these roles yet, so this URI isn’t very useful but it’s there), context is the repo/project into which access is being granted, and target is the local or remote user being given access
  • To revoke access, send an Undo activity on the previously published Grant
  • When doing activities on a repo/project that need permissions, you need to specify the Object Capability explicitly, by using the capability property in the activity object, specifying the URI of the Grant activity you previously received from that repo/project

In other words, the URI of the Grant activity is the Object Capability, and there’s no security/crypto other than the existing HTTP Signatures.

I’m just putting this info here to let you know what I’m doing. I hope the fediverse will agree on a standard way to do OCAPs eventually :slight_smile: