It shall be possible to perform user, permission and key management without interrupting the service by stopping and restarting the server.
Therefore, a new admin permission shall be introduced, which grants an account administrative privileges.
An account with these privileges shall be able to perform user, permission and key management functions, which are currently performed "offline", in an "online" manner with an authenticated session on a running server.
This includes the following functions.
- listing existing users
- retrieve an existing user's permissions
- retrieve public keys associated with an existing user
- export a public key associated with an existing user in PEM format
- retrieve device tokens associated with an existing user
- creating new users
- removing existing users
- changing an existing user's password
- adding (granting) a permission to an existing user
- removing (revoking) a permission from an existing user
- add a public key for an existing user
- remove a public key from an existing user
- issue a device token for an existing user
- removing a device token from an existing user
This list may not be complete.
The general strategy for implementation is as follows.
- Add (server-side) method to "controller.Controller" starting with the "admin" prefix, checking for the "admin" permission, performing the required request on "user.Manager" and returning the response in an appropriate (JSON-based) format.
- Integrate newly-created (server-side) method to the "controller.controllerStruct.dispatch" method.
- Add (client-side) method to "remote.Session" performing the request on the server and returning an "io.ReadCloser".
- Add method to "controller/client.Controller" evaluating the command-line arguments and invoking "remote.Session".
- Integrate newly-created (client-side) method to the "controller/client.controllerStruct.Interpret" (client-side equivalent of server-side "dispatch") method.
- Add description for new remote command to "README.md".
Hints:
- Synchronization may be necessary to prevent data corruption or exploitation.
- It may be necessary to handle "incomplete" users (e. g. user already created, but credentials not yet set) in specific ways and / or introduce new commands to flag users as either "in the process of being edited" (currently not usable or not yet usable for authentication and session establishment) or "being complete" (usable for session establishment).
- The documentation must be updated to reflect the fact that live user management is possible.
Intermediate implementation steps might be published or not, as deemed appropriate.
It shall be possible to perform user, permission and key management without interrupting the service by stopping and restarting the server.
Therefore, a new
adminpermission shall be introduced, which grants an account administrative privileges.An account with these privileges shall be able to perform user, permission and key management functions, which are currently performed "offline", in an "online" manner with an authenticated session on a running server.
This includes the following functions.
This list may not be complete.
The general strategy for implementation is as follows.
Hints:
Intermediate implementation steps might be published or not, as deemed appropriate.