[jboss-jira] [JBoss JIRA] (WFCORE-1964) Internal ModelControllerClient should bypass access control by default

[ https://issues.jboss.org/browse/WFCORE-1964?page=com.atlassian.jira.plugi... ] Brian Stansberry edited comment on WFCORE-1964 at 11/8/16 3:52 PM: ------------------------------------------------------------------- The client is obtained via service injection of a ModelController and then invoking its ModelControllerClient createClient(Executor executor) method. The ModelController interface is only implemented by us so we are free to add other methods to it, e.g. a createClient variant that somehow specifies that some sort of inflow should happen when that client is used. The default behavior should be as it was in WF 10 or earlier; calls end up with SUPERUSER-like powers. Just an FYI: I may want to refactor the ModelController interface a bit, to separate the createClient API from the "execute" API. There are two different kinds of users for those methods and it would be better if the createClient callers didn't see the "execute" methods. The createClient stuff would then be available via a capability. The "execute" stuff is purely internal to the kernel, so no capability-based access. was (Author: brian.stansberry): The client is obtained via service injection of a ModelController and then invoking its ModelControllerClient createClient(Executor executor) method. The ModelController interface is only implemented by us so we are via to add other methods to it, e.g. a createClient variant that somehow specifies that some sort of inflow should happen when that client is used. The default behavior should be as it was in WF 10 or earlier; calls end up with SUPERUSER-like powers. Just an FYI: I may want to refactor the ModelController interface a bit, to separate the createClient API from the "execute" API. There are two different kinds of users for those methods and it would be better if the createClient callers didn't see the "execute" methods. The createClient stuff would then be available via a capability. The "execute" stuff is purely internal to the kernel, so no capability-based access. -- This message was sent by Atlassian JIRA (v7.2.3#72005)