Missing description for listing directories

[paulmillar]

On page 12, various storage scopes are defined in terms of reading/downloading data, creating/uploading data, creating subdirectories, modifying existing data, deleting data and directories and renaming files.

However, this description appears to be missing any statement on directory listing is authorised.

Some possible solutions for how the document may be updated to make this clear:

1. It is not possible to authorise directory listing. Any listing operation needs some other authorisation (e.g., group-based AuthZ)
2. A storage.read scope allows directory listing.
3. A new scope is introduced that supports directory listings.

I suspect adopting solution 1. or 2. would be the easiest. There may be use-cases for 3. (e.g., catalogue synchronisation), they don't seem to have been discussed.

[maarten-litmaath]

My take at this time:

1. Any data access, directory listings included, should be made possible through capabilities.
2. That would be the easiest solution. However, as big directory listings may be expensive and cause high load on a service, a separate, possibly privileged scope might be preferable instead.
3. A new scope may be desirable indeed, as explained above.

What do people think?