New `interop:ApplicationDataGrant` type

[srosset81]

As discussed on Friday with @elf-pavlik

Currently we must create a interop:DelegatedDataGrant when sharing a data grant with an application. But this creates confusion with delegated data grants which are created for sharing data with another user.

Having a special type would help to clarify.

Application Data Grants cannot be delegated further. We can be sure we are at the "end of the chain".

[srosset81]

@elf-pavlik In my ActivityPods implementation, this is something I would need soon.

I'm thinking it would still be useful to mark a difference between grants and delegated grants. But calling them interop:ApplicationAccessGrant and interop:ApplicationDelegatedAccessGrant seems very long.

I remember now that for the interop:AccessNeedGroup, there is a interop:authenticatesAs predicate that can be either interop:SocialAgent or interop:Application.

Couldn't we have something similar for data grants, such as granteeType ?

[srosset81]

OK I implemented interop:granteeType in ActivityPods.

[elf-pavlik]

I'm sorry I didn't respond to your comment 2 weeks ago, especially that now I see you said I would need soon.

Could you clarify why do you need that and can't simply check grant.dataOwner === grant.grantedBy?
Actually I need to recall myself why we didn't do that and introduced DelegatedGrant in the first place.

It probably relates to organization/group scenarios, which are still to be specified, in that case I think grantedBy should still be the organization and which specific admin (or other person with authorized role) has done it, should be tracked with other means that don't expose that information to the grantee.

[srosset81]

Could you clarify why do you need that and can't simply check grant.dataOwner === grant.grantedBy?
Actually I need to recall myself why we didn't do that and introduced DelegatedGrant in the first place.

This issue is about identifying grants that are for applications vs. grants that for other users. This is required because, for example, the delegation limit doesn't apply for application grants. Also it will be useful for so-called "authorizers", because they will need to distinguish between users and "clients" (= applications). If they need to fetch the grantee every time to know if it is an application or an user, it's going to be complicated, and of course inefficient.

I don't know why you decided to create a specific class for delegated grants. You told me once that you preferred to change a class name instead of adding a boolean ? In my code organization, it is useful because the management of both type of resources is very different.