access control layer for resource server

[nodestory]

User story

As a server admin, I want an access control layer for my resource server so I can grant access to data on my server.

Acceptance criteria

A resource server for demonstrating capability-based authorization.

We presume the resource server already stores several resources for clients and it knows the owner (identified by Bitmark account) of each resource. How the resources are uploaded to the server is beyond the focus of this user story. The easiest way could be to issue some bitmarks in advance and put corresponding asset files in the server for the demo of the authorization.)

The resource server can grant access to a paid client.

A client who asks for access has to pay for the usage so the server has to:

• return a Lightning Network invoice for clients who want to get access to the resource to pay
• generate corresponding macaroon once the payment is done
• make the macaroon available for the client

The resource server can provide the resource to a valid client.

The client can get the resource only when:

• the payment for the access is done on Lightning Network
• the client who is requesting for access to a resource has the access right to it

The way of delivering the resource to the client side is open.

The communication between client and server is through HTTP.