views: add a REST API

[nharraud]

Note: This discussion might be a little premature as @egabancho is working on an alternative access control, but it is still interesting to have it just as a reminder.

This module needs a REST API which would enable to assign and unassign permissions to users and roles.

Relates to #72

[lnielsen]

@nharraud Can this be closed now that Invenio-Accounts-REST is here?

[egabancho]

I think we should keep it open, we still need a way to ask Invenio if a user can perform a given action from the UI, i.e. to display an edit button in the detail view.

Whether it should be here or in a different repo it's a different question.

[nharraud]

@lnielsen I agree with @egabancho. Invenio-accounts-rest just gives access to accounts and roles, it doesn't tell what permissions they have.

[lnielsen]

Ok, thanks for the update. I would still close this ticket, because what the ticket describes was achieved (assign/unassign roles). I would then open a new ticket in inveniosoftware/invenio-accounts-rest with the specific task (i.e. rest api for asking about a users can do certain actions). Otherwise I'm afraid this ticket becomes too generic.

Would that be ok?

[nharraud]

@lnielsen The tickets says "assign and unassign permissions to users and roles.", not "assign and unassign roles".

The problem is that invenio-accounts doesn't know anything about invenio-access. It's invenio-access who knows about invenio-accounts. We can add support for invenio-access in invenio-accounts-rest but it means that we indirectly create a reverse dependency between invenio-accounts and invenio-access.
For B2SHARE it is ok as we are using invenio-access, but what do we do with the alternative design of access control @egabancho was working on? I doubt that we can create a good REST API which supports multiple designs.

I would rather keep this issue here for now and put it to "someday" as, right now, nobody has a clear idea of what this permissions REST API would look like.

[lnielsen]

Ah, go it :-) My mistake, was confusing roles and permissions :-) Ok, instead I bump it to someday instead of v1 until some expresses interest in implementing it.