balanced/balanced-api — pull request #667 by mjallday (2014-07-23 15:56:15+00:00)
Title: Limited permission API keys

This is a work in progress for #290

API keys that can be constrained to either read or write to a limited sub-set of endpoints.

E.g.

A POST to `/api_keys`
```json
{
"api_keys": [{
"permissions": {
"/customers": "rw",
"/debits/WD*": "r"
}
}]
}
```

will create an API key that can create customers and read all debits whose ID starts with `WD`.

Note you can use asterisks as wildcards. URLS are matched exactly if a asterisk is not used so `/customers/CU123`does not match a permission of `{"/customers": "r"}` but it does match `{"/customers*": "r"}`

This does not implement OAuth as suggested in the [original issue](#290), this implementation seemed simpler for now but could be pushed in that direction once an MVP is out and working. I think this would be very handy for passing read only credentials for 3rd party integrations or auditors etc.

Internal implementation exists at https://github.com/balanced/balanced/pull/7