Opened 5 years ago
Closed 5 years ago
#30781 closed New feature (needsinfo)
New feature: field permissions based on data classification
| Reported by: | Tankske | Owned by: | nobody |
|---|---|---|---|
| Component: | contrib.auth | Version: | |
| Severity: | Normal | Keywords: | Field permission data classification |
| Cc: | Triage Stage: | Unreviewed | |
| Has patch: | no | Needs documentation: | no |
| Needs tests: | no | Patch needs improvement: | no |
| Easy pickings: | no | UI/UX: | no |
Description
### Is your feature request related to a problem? Please describe.
I would like to classify entity properties according to a specific perspective and the manage access to them via permissions based on these classifications.
EG. I would like to add a GDPR perspective classification (PII or non-PII). Then I would like to specify to certain users, roles or permissions if they are allowed to see PII and/or non-PII data. Another classification is confidentiality (public data, internal data, condifential and or strictly confidential)
### Describe the solution you'd like
It would be great to have an annotation such as @classify that works in a similar was as @authorize.
### Additional context
In my opinion, there are 3 levels of security being action (crud-operation), object level and field-property level. This last one is still missing. Views are an option, but it isn't fundamentalky about security, views are about representing behaviour and how you expose data. Not about if you are allowed to expose data.
Looking forward on feedback about this!
Change History (1)
comment:1 by , 5 years ago
| Component: | Uncategorized → contrib.auth |
|---|---|
| Resolution: | → needsinfo |
| Status: | new → closed |
Hi.
I'm guessing that, at least in the first pass, this is almost certainly out-of-scope for something we'd include in core, but that it might be suited to a third-party package.
In any case I think a much more substantial idea or exactly what's being proposed is needed. How would it look? Then I'd suggest some discussion on the DevelopersMailingList, and possibly a DEP before proceeding.
However... Have a look on the mailing list. There was a thread about GDPR in the last year, and there's lots of interest. From that, see what's already out there, and if your ideas can be added to those project, or supplement them somehow.
Finally, this kind of object level permissions is best handled currently by the django-guardian package, so see if you might leverage or extend that.
I think this whole area is something very interesting. The issue tracker here isn't the best place to push that forward at the state we're at though. (Again, the a approach to the mailing list with a more detailed idea is where I'd go...)
Thanks!
There was a thread