Mark/osint-hub

Fork 0

Plan: Implementation plan for case-level access control #53

New issue

Closed

opened 2026-05-13 23:52:19 +00:00 by Mark · 1 comment

Mark commented

2026-05-13 23:52:19 +00:00

Owner

Design and decompose the access control system based on research from osint-hub#52. When complete, comment on osint-hub#36 with the implementation plan.

Scope

Review research findings from #52
Design the data model: case membership table, permission grants
Design the API layer: middleware/ decorators for permission checks
Map every existing endpoint to required permission level
Plan DB migration for existing cases (migrate to owner of creator)
Identify UI changes needed for case sharing/permissions
Break into implementable sub-issues with acceptance criteria

Deliverable

A set of new issues with clear scope, acceptance criteria, and dependencies, plus an implementation order.

Depends On

osint-hub#52 - Research: Access control models

Post-Completion

Comment on osint-hub#36 with links to all sub-issues and the implementation order.

Design and decompose the access control system based on research from osint-hub#52. When complete, comment on osint-hub#36 with the implementation plan. ## Scope - Review research findings from #52 - Design the data model: case membership table, permission grants - Design the API layer: middleware/ decorators for permission checks - Map every existing endpoint to required permission level - Plan DB migration for existing cases (migrate to owner of creator) - Identify UI changes needed for case sharing/permissions - Break into implementable sub-issues with acceptance criteria ## Deliverable A set of new issues with clear scope, acceptance criteria, and dependencies, plus an implementation order. ## Depends On osint-hub#52 - Research: Access control models ## Post-Completion Comment on osint-hub#36 with links to all sub-issues and the implementation order.

Mark added the

feature-request

label

2026-05-13 23:52:19 +00:00

Mark referenced this issue

2026-05-13 23:52:24 +00:00

CRITICAL: No case-level access control — any authenticated user can access any case #36

Mark added

quickfix

and removed

feature-request

labels

2026-05-20 21:32:59 +00:00

Mark referenced this issue

2026-05-23 01:34:14 +00:00

Wire case-level access control into cases router #64

Mark referenced this issue

2026-05-23 01:35:17 +00:00

Wire case-level access control into evidence, sources, findings, leads routers #65

Mark referenced this issue

2026-05-23 01:35:22 +00:00

Wire case-level access control into orgs, people, contacts, relationships routers #66

Mark referenced this issue

2026-05-23 01:35:28 +00:00

Wire case-level access control into gather, investigations, monitoring, reports routers #67

Mark referenced this issue

2026-05-23 01:35:34 +00:00

Wire case-level access control into dashboard, entities routers + case activity endpoint #68

Mark referenced this issue

2026-05-23 01:35:52 +00:00

Migration: backfill CaseMembership for existing cases #69

Mark referenced this issue

2026-05-23 01:35:59 +00:00

Frontend: case membership UI and access-denied handling #70

Mark commented

2026-05-23 01:38:15 +00:00

Author

Owner

Triage complete. Implementation plan posted on #36 with full endpoint mapping, role hierarchy, and dependency graph.

7 sub-issues created:

#64 — Cases router + membership management (FOUNDATION)
#65 — Evidence, sources, findings, leads routers
#66 — Orgs, people, contacts, relationships routers
#67 — Gather, investigations, monitoring, reports routers
#68 — Dashboard, entities routers + case activity endpoint
#69 — Migration: backfill CaseMembership for existing cases
#70 — Frontend: case membership UI and access-denied handling

All depend on #64. Closing this triage issue.

Triage complete. Implementation plan posted on #36 with full endpoint mapping, role hierarchy, and dependency graph. **7 sub-issues created:** - #64 — Cases router + membership management (FOUNDATION) - #65 — Evidence, sources, findings, leads routers - #66 — Orgs, people, contacts, relationships routers - #67 — Gather, investigations, monitoring, reports routers - #68 — Dashboard, entities routers + case activity endpoint - #69 — Migration: backfill CaseMembership for existing cases - #70 — Frontend: case membership UI and access-denied handling All depend on #64. Closing this triage issue.

Mark

2026-05-23 01:38:51 +00:00