• 0 Posts
  • 88 Comments
Joined 3 years ago
cake
Cake day: June 17th, 2023

help-circle
  • Soviet development that was driven purely by economic considerations tends to have all the issues of modern development. Well, except car centric planning, but we know why that wasn’t a consideration ever.

    Apartment complexes that didn’t focus just on economy, tended to be way better. And that is missing from modern considerations almost always.

    Still, there’s a reason pre-Soviet areas to this day remain some of the most sought out ones.












  • However you like, REST doesn’t dictate anything there. Just be consistent and use hypermedia.

    JSON APIs almost never follow REST because they almost never use JSON as hypertext. Worse, no complete stable hypertext JSON standard exists. There’s JSON-HAL, but it lacks a way to represent resource templates (think HTML’s <form>).

    Therefore, with JSON APIs ignoring one of the most basic idea behind REST, why would anyone expect them to follow another idea of REST - consistency?

    REST is a deceptively simple concept. Any time you build an HTML website a human can navigate without consulting documentation, you’re doing it better than vast majority of swagger documented corporate APIs.




  • I’d probably add that for something like nextcloud granted scopes can be an „orthogonal”–for the lack of a better word–subset of requested scopes.

    The set of requestable scopes has to be defined by the system itself, not its specific configuration. E.g. „files:manage”, „talk:manage”, „mail:read” are all general capabilities the system offers.

    However, as a user I can have a local configuration that adds granularity to the grants I issue. E.g.: „files:manage in specific folders” or „mail:read for specific domains or groups only” are user trust statements that fit into the capability matrix but add an additional and preferably invisible layer of access control.

    It’s a fairly rare feature in the wild and is a potential UX pitfall, but it can be useful as an advanced option on the grant page, or as a separate access control for issued grants.