ironfish
ironfish copied to clipboard
iron-fish
[FIP] Ironfish auth system for Rpc call
Description
Support different level of permission for Ironfish Rpc
- Read: Read node state, no private data.
- Write: Write to local store / chain, and read permissions.
- Sign: Use private keys stored in accounts for signing, read and write permissions.
- Admin: Manage permissions, read, write and sign permissions.
I'm curious about this, because it's an important feature that we need.
Instead of Read / Write / Sign /Admin should we just do this based on RPC routes / namespaces? You could just have preset configurations called Read, Write, Sign, Admin where each one is just a set of namespaces / requests that we decide makes sense, but users could also provision keys with their own set of requests.
for instance config/getConfig is read only, but could reveal sensitive information. I would only mount this request and make it available to keys with Admin level even though it's a read only api.
const READ = [
`${ApiNamespace.node}/status`,
]
const ADMIN = [
ApiNamespace.config,
`${ApiNamespace.node}/stop`
]
class RpcKey {
key: Buffer
permissions: string[]
}
const adminKey = new RpcKey(ADMIN)
const readKey = new RpcKey(READ)
Cool, what you have mentioned above is kind of easy way to implement auth system. If everything is ok, I will try to work on it.
