Restrictions

Granular Control with Caveats

While the possibilities for access controls that can be encoded in a Caveat are virtually unlimited, the specific Caveats supported on the Tardigrade Platform today are as follows:

Specific Operations: Caveats can restrict whether an API Key can perform any of the following operations:

  • Read

  • Write

  • Delete

  • List

Bucket: Caveats can restrict whether an API Key can perform operations on one or more Buckets .

Path and path prefix: Caveats can restrict whether an API Key can perform operations on Objects within a specific path in the object hierarchy.

Time Window: Caveats can restrict when an API Key can perform operations on objects stored on the platform.

The code related to the supported Caveats (Link to specific) on the Satellite is available for review on GitHub. When the Uplink Client is used to share access to an object stored on the Tardigrade Platform, the API Key only addresses access to an object.

When an Uplink Client makes a request to a Satellite to perform an action on an object, the Satellite will evaluate the validity of the API Key and allow the action if the API Key is valid for the action and object.

In the case of sharing read access to an object, the API Key is used to allow an Uplink Client to download the pieces of a file and re-encode the pieces into a complete file, but the Uplink Client must also be able to decrypt the encrypted file for file sharing to be actually useful.

Diagram of Macaroon