Re: [Txauth] Turning polymorphism up to 11 (P11)

[Dick Hardt <[e-mail]>]

For those not familiar with "turning up to 11"
https://en.wikipedia.org/wiki/Up_to_eleven

A counter argument to all of this polymorphism is that the AS is sending
back the granted authorization. While pushing type detection to the AS to
provide a simpler interface for the Client, it seems counterproductive if
the Client has to do the same. A consistent response from the AS will be
simpler for the Client, but would then also be different then what the
Client originally requested from the GS.

On Fri, Jul 10, 2020 at 6:01 PM Dick Hardt <[e-mail]> wrote:

> Taking Justin's model of strings being shortened versions of OAuth scopes,
> adding in the "type" property from RAR, and defining a default type, we
> *could* add a bunch of polymorphism. (I have not implemented the code
> below, but it looks doable assuming I have not overloaded a type in the
> same context)
>
> /Dick
>
>
> Let's start with a request for 2 authorizations using OAuth scopes, one
> for writing and the other for reading:
>
> (1)
> {
>     "authorizations": {
>         "writer": [
>             {
>                 "type": "oauth_scope",
>                 "scope": ["create","update","delete"]
>             }
>         ],
>         "reader": [
>             {
>                 "type": "oauth_scope",
>                 "scope": ["read","list"]
>             }
>         ]
>     }
> }
>
> We can ask for just one token with all the same capabilities:
> (2)
> {
>     "authorizations": [
>         {
>             "type": "oauth_scope",
>             "scope": ["create","update","delete"]
>         },
>         {
>             "type": "oauth_scope",
>             "scope": ["read","list"]
>         }
>     ]
> }
>
> Of course (2) can be simplified as:
> (3)
> {
>     "authorizations": [
>         {
>             "type": "oauth_scope",
>             "scope": ["create","update","delete","read","list"]
>         }
>     ]
> }
>
> Now let's say that in "oauth_scope", the array of scopes can also be a
> space separated string. So the following is equivalent:
> (4)
> {
>     "authorizations": [
>         {
>             "type": "oauth_scope",
>             "scope": "create update delete read list"
>         }
>     ]
> }
>
> Now let's say that the "oauth_scope" type is the default, so we can
> express it as:
> (5)
> {
>     "authorizations": ["create","update","delete","read","list"]
> }
>
> Or use a space separated string instead of an array:
> (6)
> {
>     "authorizations": "create update delete read list"
> }
>
> In summary, (2) - (6) will give the exact same result.
>
> Let's add another authorization type to the request,
> "customer_information":
> (7)
> {
>     "authorizations": [
>         "create update delete read list",
>         {
>             "type": "customer_information",
>             "locations": [
>                 "https://example.com/customers",
>             ],
>             "actions": [
>                 "read"
>             ],
>             "datatypes": [
>                 "contacts",
>                 "photos"
>             ]
>         }
>     ]
> }
>
> And the space separated strings can be turned into individual strings and
> we have the equivalent request:
> (8)
> {
>     "authorizations": [
>         "create",
>         "update",
>         "delete",
>         "read",
>         "list",
>         {
>             "type": "customer_information",
>             "locations": [
>                 "https://example.com/customers",
>             ],
>             "actions": [
>                 "read"
>             ],
>             "datatypes": [
>                 "contacts",
>                 "photos"
>             ]
>         }
>     ]
> }
>
> Let's go back to our first example, and ask for 3 separate tokens:
> (9)
> {
>     "authorizations": {
>         "writer": "create update delete",
>         "reader": "read list",
>         "customer": [
>             {
>                 "type": "customer_information",
>                 "locations": [
>                     "https://example.com/customers",
>                 ],
>                 "actions": [
>                     "read"
>                 ],
>                 "datatypes": [
>                     "contacts",
>                     "photos"
>                 ]
>             }
>         ]
>     }
> }
>
> In a multi token request, if there is only one item in the array, we can
> shorten (9) to the following:
> (10)
> {
>     "authorizations": {
>         "writer": "create update delete",
>         "reader": "read list",
>         "customer": {
>             "type": "customer_information",
>             "locations": [
>                 "https://example.com/customers",
>             ],
>             "actions": [
>                 "read"
>             ],
>             "datatypes": [
>                 "contacts",
>                 "photos"
>             ]
>         }
>     }
> }
>