[
https://issues.apache.org/jira/browse/SLING-13250?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Burkhard Pauli updated SLING-13250:
-----------------------------------
Description:
h4. Problem
When a distribution is triggered on behalf of a human user (for example a
replication/publish request bridged into Sling Content Distribution), the
identity of the triggering user is lost on the way down the stack.
A {{DistributionPackageBuilder}} (and the {{DistributionContentSerializer}} it
delegates to) only ever sees the distribution agent's own service
{{ResourceResolver}}, so it has no way to find out which user actually
triggered the request. Some consumers need this information (e.g. to run
per-user pre-requisite checks before building the package, or to record
provenance).
h4. Proposal
Provide a supported way to carry the triggering user's id on the
{{DistributionRequest}} so that downstream components (package builders,
content serializers, filters) can read it. Possible options:
* an optional accessor on {{DistributionRequest}} (e.g.
{{getTriggeringUserId()}} / returning {{Optional<String>}}), or
* a well-known, documented request property/attribute that carries the id.
The value should be optional and default to {{null}}/empty when the triggering
user is unknown (e.g. system-triggered distributions).
was:
h4. Problem
When a distribution is triggered on behalf of a human user (for example a
replication/publish request bridged into Sling Content Distribution), the
identity of the triggering user is lost on the way down the stack.
A {{DistributionPackageBuilder}} (and the {{DistributionContentSerializer}} it
delegates to) only ever sees the distribution agent's own service
{{ResourceResolver}}, so it has no way to find out which user actually
triggered the request. Some consumers need this information (e.g. to run
per-user pre-requisite checks before building the package, or to record
provenance).
h4. Proposal
Provide a supported way to carry the triggering user's id on the
{{DistributionRequest}} so that downstream components (package builders,
content serializers, filters) can read it. Possible options:
* an optional accessor on {{DistributionRequest}} (e.g.
{{getTriggeringUserId()}} / returning {{Optional<String>}}), or
* a well-known, documented request property/attribute that carries the id.
The value should be optional and default to {{null}}/empty when the triggering
user is unknown (e.g. system-triggered distributions).
h4. Context
As a stop-gap, a provisional Granite-level interface
({{com.adobe.granite.distribution.core.UserAwareDistributionRequest}}) was
added downstream to carry this id from the replication-to-distribution bridge.
That interface is explicitly documented as temporary and is intended to be
removed once this capability exists in the Sling Content Distribution API
itself.
> Carry the triggering user on DistributionRequest
> ------------------------------------------------
>
> Key: SLING-13250
> URL: https://issues.apache.org/jira/browse/SLING-13250
> Project: Sling
> Issue Type: Improvement
> Components: Content Distribution
> Reporter: Burkhard Pauli
> Priority: Major
>
> h4. Problem
> When a distribution is triggered on behalf of a human user (for example a
> replication/publish request bridged into Sling Content Distribution), the
> identity of the triggering user is lost on the way down the stack.
> A {{DistributionPackageBuilder}} (and the {{DistributionContentSerializer}}
> it delegates to) only ever sees the distribution agent's own service
> {{ResourceResolver}}, so it has no way to find out which user actually
> triggered the request. Some consumers need this information (e.g. to run
> per-user pre-requisite checks before building the package, or to record
> provenance).
> h4. Proposal
> Provide a supported way to carry the triggering user's id on the
> {{DistributionRequest}} so that downstream components (package builders,
> content serializers, filters) can read it. Possible options:
> * an optional accessor on {{DistributionRequest}} (e.g.
> {{getTriggeringUserId()}} / returning {{Optional<String>}}), or
> * a well-known, documented request property/attribute that carries the id.
> The value should be optional and default to {{null}}/empty when the
> triggering user is unknown (e.g. system-triggered distributions).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
