Subject: VCAR question

From: [email-masked] (Steve Mansour)
Date: Tue, 11 Dec 2001 14:03:32 -0800

Does "write" permission to a VAGENDA give you the right to move another
VAGENDA into it?
-Steve

---

From: "Paul B. Hill" <[email-masked]>
Date: Tue, 11 Dec 2001 19:10:22 -0500

Hi,

There is no "write" VCAR action or permission...

From cal-updates:

"The ACTION rule part defines one or more CAP actions that are allowed
for the UPN. The valid values are CREATE, DELETE, MODIFY, MOVE, READ,
and all of the [iTIP] scheduling commands; PUBLISH, REQUEST, REPLY,
ADD, CANCEL, REFRESH, COUNTER, DECLINECOUNTER, corresponding to the
scheduling commands; and '*', meaning all of calendaring commands and
scheduling commands. Multiple ACTION enumerations can be specified as a
COMMA character (US-ASCII decimal 44) separated list of ACTION
enumerated values. The text '*' is the same as specifying the
enumerated values "CREATE,MODIFY,DELETE,READ,MOVE",."

So, if I grant you CREATE access you can create an entire VAGENDA heirarchy.
The file system analogy would be like giving you the ability to create new
subdirectories.

I don't think MOVE would provide you with the same ability.

At the moment I think MODIFY is underspecified in this case. I suspect most
people would think that MODIFY would give you this ability as well. Is that
what we want?

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]]On Behalf Of Steve Mansour
Sent: Tuesday, December 11, 2001 5:04 PM
To: CalSched IETF
Subject: VCAR question

---

From: [email-masked] (Steve Mansour)
Date: Tue, 11 Dec 2001 18:40:05 -0800

> There is no "write" VCAR action or permission...

And by "write", of course, I meant "CREATE"  :-)

> ...

why not?  Following your file system analogy, I can move a file into a directory
to which I have write access.

> people would think that MODIFY would give you this ability as well. Is that

so, you're modifying the CHILDREN property of a calendar?  OK this works for
me.  How do others feel about this?

-Steve

---

From: Doug Royer <[email-masked]>
Date: Tue, 11 Dec 2001 23:58:10 -0700

Steve Mansour wrote:
> > So, if I grant you CREATE access you can create an entire VAGENDA
> > heirarchy.  The file system analogy would be like giving you the
> > ability to create new subdirectories.
> >
> why not?  Following your file system analogy, I can move a file
> into a directory to which I have write access.

In CAP - GRANT is not a blanket GRANT to all objects.
You have to GRANT something. When we invented the VCAR in Orlando,
VAGENDA did not exist. But it can fit into the model:

	DENY:UPN=xxx;...OBJECT=VAGENDR....
or
	DENY:UPN=yyy:...OBJECT=VCALENDAR...

or
	GRANT:UPN=xxx;...OBJECT=VAGENDR....
or
	GRANT:UPN=yyy:...OBJECT=VCALENDAR...

> 
> > At the moment I think MODIFY is underspecified in this case.
> > I suspect most people would think that MODIFY would give you
> > this ability as well. Is that what we want?

MODIFY is for modifying objects or entries in objects.
As you can not specify two targets in MODIFY, it can't be used
for that.

> me.  How do others feel about this?

That will not work as you have to also MODIFY the parent of the other.

Moving a calendar was discussed on this list just a month or so
ago, I thought everyone wanted it to be a MOVE (not MODIFY) command.
In fact that is one of the issues I have with 06 - the MODIFY command
changed without any WG list discussion. 

And MOVE was updated to allow moving calendars.

---

From: [email-masked] (Steve Mansour)
Date: Wed, 12 Dec 2001 08:31:03 -0800

> That will not work as you have to also MODIFY the parent of the other.

wait... that should work fine. The person that's moving the calendar is most
likely the owner

> changed without any WG list discussion.

hmm... I think we're not connecting here.  We all want the MOVE command. We're
just looking at what VCAR(s) are necessary to accomplish the move.

> And MOVE was updated to allow moving calendars.

yep.

-Steve

---

From: [email-masked] (Steve Mansour)
Date: Wed, 12 Dec 2001 08:31:03 -0800

yep.

-Steve

---

From: Bernard Desruisseaux <[email-masked]>
Date: Wed, 12 Dec 2001 12:09:51 -0500

> enumerated values "CREATE,MODIFY,DELETE,READ,MOVE",."

Actually, this paragraph is not in line with the ABNF,
which specifies CREATE, MODIFY, DELETE, READ and * as
the only valid values for ACTION.

By looking at the CARID:REQUESTONLY example,

      BEGIN:VCAR
      CARID:REQUESTONLY
      GRANT:UPN=NONOWNER;ACTION=CREATE;OBJECT=*
      ;OBJECT=METHOD;VALUE=REQUEST
      END:VCAR

it seems that the original intent was not to use the
ACTION rule part to restrict RIGHTS to submitted
VCALENDARs with a matching METHOD property, but rather
to restrict RIGHTS to the submitted VCALENDARs that
will require the specified ACTION to take place.

For instance, for a "move" command to succeed a user
should have the READ and DELETE ACTION granted for the
source calendar (or CS) and the CREATE ACTION granted
for the destination calendar (or CS).  We shouldn't
need a MOVE ACTION.

Furthermore, the MODIFY ACTION could probably be
eliminated, given that if you can READ and CREATE
you can MODIFY.

The relationship between the CAP commands (i.e.,
create, delete, modify, move, search and schedule)
and the CAP actions should be clarified.  Renaming
the ACTION CREATE to WRITE would probably help
reducing the confusion.

> Does "write" permission to a VAGENDA give you the right to move another

As I said above, only if you have the READ and DELETE
ACTION granted for the source calendar (or CS) as well.

Regards,
Bernard
-- 
Bernard Desruisseaux                    mailto:[email-masked]
Research & Development                  Tel.  : +1 514 733-8500 x4213
Steltor                                 Fax   : +1 514 733-8878

---

From: Doug Royer <[email-masked]>
Date: Wed, 12 Dec 2001 15:35:32 -0700

> eliminated, given that if you can READ and CREATE

No they are not the same.
- I can make a VCAR that allows you only to MODIFY
your PARTSTAT - but I do NOT want you to CREATE
anything new and I do not want you to READ anything at all.

> the ACTION CREATE to WRITE would probably help

OR we could rename the command to CREATE as WRITE implies
modify as you pointed out above.

---

From: Bernard Desruisseaux <[email-masked]>
Date: Wed, 12 Dec 2001 17:49:37 -0500

> anything new and I do not want you to READ anything at all.

I see.

> modify as you pointed out above.

You lost me.  Rename which command?

Regards,
Bernard

---

From: Doug Royer <[email-masked]>
Date: Wed, 12 Dec 2001 16:54:00 -0700

> You lost me.  Rename which command?

Rename the WRITE command to CREATE (or is that a BXXP thing?).

---

From: Bernard Desruisseaux <[email-masked]>
Date: Fri, 21 Dec 2001 12:44:23 -0500

Doug Royer wrote:
> Rename the WRITE command to CREATE 

There is no WRITE command in CAP.

> (or is that a BXXP thing?).

I don't know what you mean by that.

I proposed to rename the ACTION CREATE (not the "create"
command) to WRITE (i.e., ACTION=WRITE) to make it clear
that is doesn't only apply to the "create" command.

Is that okay with you?

Regards,
Bernard