ares/foreman — pull request #3 by eLobato (2014-01-12 03:48:58+00:00)
Title: API v2 migration to new permissions model

I will fix this commit and write something more meaningful. API v1 will follow shortly, v2 doesn't differ much from v1 in this regard.

For the moment we can use this for discussion, I jotted down a few questions that raised while I was doing this:

- How are we testing permissions work well, when permissions are in nested usergroups, etc..?
- Why is ```auth_source_ldaps``` not using ```authorized``` for anything?
- Why do we have a permission ```ipmi_boot``` under resource Hosts? I'd suggest change it to ```boot_hosts``` (it makes some things easier, and its more homogeneous with the rest)
- Why ```HostgroupClass, HostClass``` miss view/destroy permissions?
- What to do in ```os_default_template``` API controller? There's no permission for that, check permissions for ```config_templates``` maybe?
- ```LookupKeys``` have permissions like ```view_external_variables```, why? They can also be smart_class_parameters, or better yet, lookup_keys :tongue:
- ```LookupValues``` have no permissions?
- ```Roles``` have no permissions?
- What are ```Parameter``` permissions used for? Shouldn't the permissions of the object that contains these parameters be used instead? (i.e: :view_hosts instead of :view_parameters for /api/hosts/1/parameters) That's the approach I followed with NIC interfaces.
- Regular controllers should have an ```after_filter``` to set the ```@authorizer``` variable, want me to do that?
- Are we going to auto prepend ```authorized(:whatever)``` to methods like ```search_for```, etc.. which will always clearly need it? Otherwise writing new code might get hairy, I have very mixed feelings about this.
- If not, we'll be on the lookout for the ```authorized``` scope forever?

I saw some errors not related to this that don't have an issue in redmine that I'll open tickets for them soon too:

- Users #update checks for email existence, #create does not.
- build_pxe needs some error handling
- autosign_controller returns 500 when the smart proxy is unreachable

Thanks!