►
From YouTube: Authorization. How to restrict an access to API
Description
We have learned how to provide and compose API in the open π2π network. Now, how do we restrict an access to it?
Workshop, at Hack the System hackathon
Speaker: Alexey Pyshnenko
Engineer at Fluence Labs
----
Source https://youtu.be/om038Mnzj_w
Workshop flow https://www.notion.so/Fluence-Workshop-hands-on-2-network-choreography-83beddecd2194a4789039406a85224df
Hack the System hackathon challenges https://medium.com/encode-club/hack-the-system-announcing-fluence-87fa8dae59
Get started with Fluence https://fluence.dev/docs
Protocol Paper https://github.com/fluencelabs/rfcs/blob/main/0-overview.md
Developer Hub https://dash.fluence.dev/
Github https://github.com/fluencelabs
Fluence Home https://fluence.network/
A
So,
okay,
maybe
my
previous
words
about
anyone
having
access
to
any
ap
frightening,
because
you
know
if
anyone
can
call
the
storage
put
api
on
my
computer.
I
wouldn't
be
really
happy
about
it
because
one
morning
I
get
up
and
I
see
a
terabyte
file
put
into
my
macbook
and
it
has
not
so
much
gigabytes
left
there
and
I
have
no
free
disk
space
and
it's
one
way,
and
it
could
be
worse
worse
than
that,
so
we
have
to
protect
our
apis.
We
have
to
manage
the
authorization.
A
A
But
okay,
I'm
I'm
going
to
do
it
too
far.
So
the
first
thing
every
service
internally
has
an
access
to
this
function.
You
can
always
call
get
call
parameters
from
any
service
in
any
function
and
you
will
get
security
metadata
that
will
contain
information
about
whoa
whoa.
Why?
Where
something
happened
and
everything
scrolled,
you
will
have
information
about
who
sent
the
request.
That's
in
your
parade,
you
need
period.
As
we
see
in
person,
science,
you
will
be
able
to
know
who
has
created
the
service,
who's,
the
service
creator
or
owner
and
for
example.
A
But
you
have
more
info
than
that.
The
getco
parenters
function.
It
returns
the
following
structure:
it
has
the
following
fields,
so
the
current
call
initiator
the
current
service
id.
If
you
need
to
check
against
it,
for
example,
if
you
want
to
check
that
it
wasn't
redeployed
or
something
the
id
of
the
service
creator,
so
you
can
know
who
created
the
service
the
idea
of
the
current
peer
that
hosts
this
service.
A
B
A
Information
to
other
function
would
you
believe
it
like?
If
someone
gives
me,
I
am
no,
I'm
the
owner
equals
true
and
there's
the
authorization,
no,
because
that
data
could
be
easily
hijacked
right.
Anyone
can
emit
a
true
result
in
the
script
I
can
put
through
in
the
data
and
just
feed
here,
a
true
value
without
going
to
his
ordinary
code,
without
calling
his
owner
function.
A
A
Okay,
I
have
20
minutes
left.
I
will
do
in
20
minutes
so
here
where
tetraplex
come
into
play.
So
for
each
argument,
that's
pass
that
is
passed
to
the
as
an
argument
or
function.
For
example,
we
want
to
extend
storage,
put
with
check
of
authority
to
check
that
the
only
owner
can
write
files
to
the
file
system,
for
example.
A
Then,
when
we
do
this,
when
we
call
put
function
with
just
three
values
for
these
three
arguments,
the
following
happens
with
each
of
the
argument:
we
have
a
corresponding
security
catalog.
So
for
each
of
these
values
we
will
have
a
single
fetcher
plan.
That
say
says
where
this
value
comes
from
from
what
node
from
what
service
from
what
function,
and
was
it
modified
in
any
way
by
jsonpath?
A
I
mean
that
didn't
succeed
so
inside
the
e
is
authenticated.
We
get
the
security
net
information,
we
get
the
first
tetraplet
for
we
know
the
first
argument
to
the
function
his
owner
is
his
owner
and
we
check
that
this
tetraplate
is
correct,
but
it's
a
correct
service
id.
It
has
correct
function,
name
and
it
has
no
json
path
applied
to
it.
A
A
It
uses
the
the
following
logic:
almost
the
same
logic,
to
authenticate
users,
so
only
owner
of
the
service
can
add
users
to
that
editor
right.
It
makes
sense.
If
I
don't
want
anyone
to
do
anything
with
my
text
that
I
myself
deployed-
and
I
edited
it
with
my
friend-
I
don't
want
anyone
to
interfere
with
that.
A
A
Great,
so
I
will
do
that
in
five
minutes:
cool,
so
go
to
fluentpad
services
with
me.
Follow
it
and
deploy
services
on
your
own
and
see
how
it
works.
You
will
see
that
in
order
to
use
the
fluidpad
app,
you
have
to
first
set
chatter
plan.
So
as
an
owner
of
the
friend
part,
as
one
who
deployed
you
have
to
say
to
it,
in
which
data
to
trust
which
json
path
to
trust
which
function
is
correct,
which
service
is
okay
and
so
on?
You
have
to
do
that,
so
the
service
knows
who
to
drive.
A
A
So
if
you
are
to
use
a
wrong
json
path,
for
example,
you
will
have
the
following
error:
that
jsonpath
was
expected
to
be
like
that,
and
jsonputs
actually
was
like
that.
So
if
date
is
forced
from
some
in
some
way
or
it
comes
from
a
different
source
that
you
didn't
allow,
it
will
fail,
you
can
check
against
you.
Can
change
check
the
authenticity
of
the
data.
It's
original,
it's
kind
of
like
across
a
region,
request
policy,
that's
what
we
were
inspired
by.
So
it's
kind,
it's
kind
of
like
that.
A
That
shows
all
the
services
running
on
the
nodes
on
the
testnet.
We
have
documentation
here
that
overviews
the
language.
It
overviews,
how
to
develop
services,
how
to
line
launch
your
unknown
the
structure
of
the
language.
What
built-in
services
you
able
to
use
there
are
plenty
of
them.
It
talks
about
the
authorization
in
detail
and
explains
different
things.
It
has
extra
resources
with
youtube
talks
and
stuff.
A
It
has
links
to
our
telegram
to
our
discord,
to
the
dashboard
and
to
discussions
on
github.
Please
use
it.
It's
a
really
nice
way
to
to
discuss
and
to
share
your
knowledge
to
reduce
knowledge.
Your
usage
is,
there
is
a
point
of
difference.
So
here
is
the
dashboard.
Dashboard
connect
contains
a
few
of
the
future
blueprints
which
shows
nodes
that
are
in
the
test
net.
You
can
see
that
I
was
saying
that
the
third
node
is
the
most
used
one.
You
can
see
that
it
has
almost
400
services
deployed
into
it.