Implement authentication for the assignment API

[danidoni]

No description provided.

[krauselukas]

@danidoni I think the assignment policy should be used instead

open-build-service/src/api/app/policies/assignment_policy.rb

Line 5 in dcf1bba

def create?

collaborators can create/delete assignments as well

[danidoni]

Alright, I'll fix it

[danidoni]

So, looking at the policy, that uses this, looks like it allows to assign collaborators, that is not the same than allowing collaborators to assign someone else. I'm I right?

[hennevogel]

No I don't think you are right. You can create an assignment (assingn someone) if you have a relationship with the Project/Package.

[krauselukas]

I think the policy is missing to authorize the assigner... that should be there IMO, talking to @hellcp-work

[danidoni]

@hennevogel alright, but what this policy is doing is assigning someone if that someone is a collaborator, am I reading it right? In other words, if the assignee is a collaborator, but what you say is that the assigner is a collaborator, that is not what this policy is doing.

[krauselukas]

@danidoni @hennevogel that should be the change that is required #18791