Mailing-List: contact esme-dev-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: esme-dev@incubator.apache.org
Received-SPF: pass (athena.apache.org: domain of esjewett@gmail.com designates
 209.85.222.174 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:in-reply-to:references:date:message-id:subject:from:to
         :content-type;
        b=ldPr3g+kopkLU9VDbeu8OkOkRKXabNnedU7gN4jYC5EpMnj+5ly8b3tHBeHQIoGBjp
         nUjMmnXrQxxOY4UUFABVVZvd/+y8ssin2ynmE7JBBu+T/AQEfYcVWD5rX/LoAxSq9h6B
         1ilumdEy2lZySVGgjIlLYiZKfL8dGNjdvgta8=
MIME-Version: 1.0
In-Reply-To: <fa2d9f451001010010y3c27cd33l7d66885147963922@mail.gmail.com>
References: <68f4a0e80912311547i6ad05615x2ee0273c51dbc9d9@mail.gmail.com>
	 <fa2d9f451001010010y3c27cd33l7d66885147963922@mail.gmail.com>
Date: Fri, 1 Jan 2010 10:16:38 -0600
Message-ID: <68f4a0e81001010816r38aea5d6iac01dc978e90015b@mail.gmail.com>
Subject: Re: Big (first) commit
From: Ethan Jewett <esjewett@gmail.com>
To: esme-dev@incubator.apache.org
Content-Type: text/plain; charset=ISO-8859-1

On Fri, Jan 1, 2010 at 2:10 AM, Richard Hirsch <hirsch.dick@gmail.com> wrote:
> Strange that your commit was registered on this list....

That is odd. I sent it to esme-commits@incubator.apache.org

> I think this is fine for now but we don't want to recreate the lift
> authorization functionality. Is there a migration path possible?

The migration path would be to just switch the mechanism over to Lift
authorizations. However, those don't appear to be suitable. To quote
myself:

1. The Lift httpAuthProtectedResource method that all the examples use
to tie roles to actions in the application is not suitable for a
RESTful API approach, since it ties authorization to the resource
rather than the resource/method combination (translation: you can't
have a resource with different authorization roles for read and
write, and we need this, at least for the api2/users resource).

2. Using LiftRules.httpAuthProtectedResource seems to require the use
of LiftRules.authentication to authenticate requests. [That is, I
don't see a way to do authorization based on the current user as
derived from the session.] Unfortunately it
looks like you can only define one authentication method per
application (I may be missing something here), and since the Twitter
API is already using Basic authentication, we can't use a different
method for the administration API parts of API2.

I need to send that email to the Lift list asking for help...

> [ESME-xxx] JIRA title
> Extra text
>
> xxx = number from Jira
> JIRA title = Jira title
> Extra text is optional and says whether it is a patch, etc.

Thanks, I'll do that in the future. Does that format result in the
Jira comment posting from Hudson automagically?

Thanks,
Ethan