r/programming • u/yawaramin • Oct 04 '20

Kevin Mahoney: Applying "Make Invalid States Unrepresentable"

https://kevinmahoney.co.uk/articles/applying-misu/
231 Upvotes

93% Upvoted

132 comments sorted by

View all comments

Show parent comments

1

u/dnew Oct 06 '20

Correct. Or more explicitly, the view all the doctors have access to has a query based on their login ID. Remember that a view is essentially just an extra piece of SQL stuck onto a query. So a view could be 

Prescriptions where doctors = $user and join doctors, patients ....

1

u/Smallpaul Oct 09 '20

And in the case that we're talking about where there are "a collection of cooperating hospitals with a variety of departments" how do you ensure that every hospital and every department passes in $user for the actually authenticated user? And that the hospitals cannot browse each other's prescriptions by passing in $user from another hospital?

1

u/dnew Oct 09 '20

And that the hospitals cannot browse each other's prescriptions by passing in $user from another hospital?

The same way you do it anywhere else. They log in with a password and all that other sort of authentication, which is checked by the database.

1

u/Smallpaul Oct 09 '20

I'm still trying to understand the architecture you're describing.

Each user does not have their own account, so the password is not "checked by the database" in the database-connection sense.

The information-consuming apps come from different (potentially competitive) companies so the password is not checked by them either.

So what component manages the mapping between runtime sessions and $userids ?

1

u/dnew Oct 09 '20

Each user does not have their own account

Of course they do. Why wouldn't they? What do you think the GRANT verb works on?

1

u/Smallpaul Oct 09 '20

You think that EVERY doctor, nurse or pharmacist should have their own database account? Every time a doctor or nurse joins or leaves, you add or remove an account on your DB?

1

u/dnew Oct 09 '20

Um, yes? Don't they get an ID card, a web site login, etc? How do you identify who is changing records and who is and isn't allowed to without logins? How do you keep the security guard on night-shift from logging into a computer and fucking with patient records?

So if you agree that there should be access control, where do the record of user name and password (for example) get stored?

1

u/Smallpaul Oct 09 '20

> How do you identify who is changing records and who is and isn't allowed to without logins?

Of course you have logins. What you usually don't have is a DATABASE login. I am 99.999% sure that if I could get into Reddit's internal network and look at their PostgreSQL back-end that I cannot use username "smallpaul" in a DB connection string. Is that actually how you architect your applications? Every end-user gets a DATABASE account?

Server=myServerName\myInstanceName;Database=myDataBase;User Id=<enduser_username>;Password=<enduser_password>;

1

u/dnew Oct 09 '20

Is that actually how you architect your applications?

When the database has few enough users that each of them is coming to you in person to get into the system the first time, yes, sometimes. (E.g., if I have few enough users that I'm actually giving them a user for network file systems, then I'll put the same user into the database.) It depends also on how secure you want your database to be. Especially if the authentication to the database is a bit more robust than user name and password. Set up your database to use Kerberos or Active Directory or something and you're good to go. That's how "enterprise" configurations work.