Disable actions on certain paths

[tbsbdr]

Description

User Stories

• As an organisation who stores all data within a monolithic path like /cernbox/eos/users/... I want to restrict certain actions above the folders users and projects so that users can not perform malicious actions on these folders.

Value

Acceptance Criteria

• prohibit copy on certain path

Definition of ready

[ ] everybody needs to understand the value written in the user story
[ ] acceptance criteria has to be defined
[ ] all dependencies of the user story need to be identified
[ ] feature should be seen from an end user perspective
[ ] user story has to be estimated
[ ] story points need to be less then 20

Definition of done

• Functional requirements
  [ ] functionality described in the user story works
  [ ] acceptance criteria are fulfilled
• Quality
  [ ] code review happened
  [ ] CI is green
  [ ] critical code received unit tests by the developer
  [ ] automated tests passed (if automated tests are not available, this test needs to be created and passed
• Non-functional requirements
  [ ] no sonar cloud issues

relates to:
1563e15

[kulmann]

@diocas @elizavetaRa @labkode

I currently see three buckets:

• actions with write operations like delete or rename: should be prevented by removing write access in webdav permissions
• folder or archive download: there's a capability in the files.archivers capability to set an upper bound for archive sizes. the web ui will show a disabled Download action with a tooltip (text similar to "max archive size exceeded")
• other read operations like Copy cannot be prevented at the moment.

To make this actionable, please add a complete list of actions file actions including a statement (per action) if it should be available or unavailable.

[diocas]

I think you covered the actions needed.

[kulmann]

I think you covered the actions needed.

So

* other read operations like Copy cannot be prevented at the moment.

is fine by you? 🤔

[diocas]

Ah no, we wanted to prevent that. I though you said you didn't cover it yet (meaning, would have to be added).

[tbsbdr]

Question to @elizavetaRa @diocas

• it is sufficient to prohibit copy in web only, correct?

[elizavetaRa]

yes