start refactoring creds behaviour for address #849
Conversation
paulo-ocean
requested review from
alexcos20,
bogdanfazakas,
jamiehewitt15 and
mariacarmina
as code owners
src/utils/credentials.ts
Outdated
| // if no address-based credentials are defined (both allow and deny lists are empty), access to the asset is restricted to everybody; | ||
| // to allow access to everybody, the symbol * will be used in the allow list; | ||
| // if a web3 address is present on both deny and allow lists, the deny list takes precedence | ||
| // and access to the asset is denied for the respective address. |
There was a problem hiding this comment.
I'm kind of surprised that we agreed to implement this change. So the default behaviour is that if an asset published, no one can access it? Seems contrary to our mission statement 🤔
There was a problem hiding this comment.
that's copied from the specs yes #804 #810 OceanProtocolEnterprise#25
makes perfectly sense to me for security reasons.
There was a problem hiding this comment.
It makes sense to enterprise users... In the past Ocean has always taken the approach that everything is open by default and Enterprises must take extra steps if they don't like the default. So this is a fundamental shift in that approach
There was a problem hiding this comment.
i'm not gonna discuss that... please check with @alexcos20 . I just followed the specs and they make sense to me
There was a problem hiding this comment.
I don't see anything changing if we have a discussion, you may as well just go ahead. Nothing wrong with the implementation
…-accessList add support for accessList on download checkCredentials
# Conflicts: # src/@types/DDO/Credentials.ts # src/test/unit/credentials.test.ts # src/utils/credentials.ts
# Conflicts: # package-lock.json # package.json
Fixes #810 #804
Changes proposed in this PR: