I'm fairly new to Collection+JSON. I have a bunch of questions regarding Collection+JSON and user operations.
Use Case
Having user permissions in a Collection+JSON response would be useful in telling the client what operations can be enacted on a particular object. As an example, it would allow the client to know which "buttons" to render on the user interface.
Questions
- Should the user's permissions be bundled into the Collection+JSON response?
- Should the user's permissions be bundled into a separate call to the user object?
- Is this beyond the scope of Collection+JSON?
Thoughts
My personal thought is that user permissions should be stored in a user object for a separation of duty, however, if this is the case then every request should then be paired with a request for a user object. This doesn't seem like a correct methodology.
Examples
In the following examples, "permissions" are represented by an integer value where 1 represents read, 2 represents create, 3 represents update, and 4 represents delete. The server will always validate the user's request, but this would make it easier for the client to know what operations can be done to the object.
1. Bundled in the response
"Permissions" could be added to the Collection+JSON specification, but this would be modifying the specification.
{
"collection" :
{
"rel" : {string},
"href" : {string},
... links, queries, items, etc...
"permissions" : { integer value }
}
}
2. Bundled in the User object
Permissions are stored in the user object and change based on the URL to provide the client with information on what this user can do at this particular state in the application.
{
"collection" : {
items: [{
... name, username, etc...
"permissions" : { integer value }
}]
}
}
3. Beyond the scope
According to the draft specification:
The Collection+JSON hypermedia type is designed to support full read/write capability for simple lists.
I suspect that by providing a Collection+JSON response, it is assumed that all CRUD operations are available to the client and that the server will provide the appropriate response when a request is made.