Re: Security Checks in API functions

Putting together some of the insights gleaned from the discussion, lets 
look at a real, "complex" case. Take for example the roles getall 
function roles_userapi_getall

I call this case complex because the function returns "nontrivial" data, 
in this case an array of roles.

- on the one hand, there is a case for having the security check for 
accessing an array of roles in the API function. The caller will be 
interested not only in the actual array returned, but if there is say a 
pager involved may also want to access the total number of array 
elements, while the actual array returned may by a subset of that. In 
order to do all this, whatever filtering happens (including security 
checks) would need to happen ideally in the function itself rather than 
the caller.

- on the other hand, the caller may want to check security in different 
ways: READ or EDIT access, say. This would argue for having the caller 
do the filtering.

It seems that in such a case there is no clearcut solution in the way 
Xaraya currently handles such situations. I purposely picked getall 
because it appears pretty much in most modules, so this is hardly an 
uncommon situation.

Note that if getall was returning trivial data, such as a create 
function which justs returns 0/1 on completion, the first point above 
would fall away and the case for having the security check in the caller 
would be stronger.

My conclusion is that there will either be different solutions to these 
types of cases, or if a single solution then we need to rethink function 
calls such as getall.