Project

General

Profile

Actions
Copy link

Idea #3171

closed

[API] Modify permission model to allow users to see a subset of other users, according to group permissions/membership.

Added by Tom Clegg over 10 years ago. Updated about 10 years ago.

Status:
Resolved
Priority:
Normal
Assigned To:
Tom Clegg
Category:
API
Target version:
2014-08-27 Sprint
Start date:
08/20/2014
Due date:
Story points:
2.0

Description

Currently, we have

Permission links Behavior
No permission path from userA to userB userA can see selected attributes of userB via users#index (as needed by the Sharing tab).
{userA} can_read {groupG} can_read {userB} userA can read anything userB can read.

This should change to

Permission links Behavior
No permission path from userA to userB userA cannot see that userB exists.
userB's uuid might appear in objects, but
GET /users/userB will yield 404
GET /users will not mention userB)
{userA} can_read {groupG} can_read {userB} userA can see selected attributes of userB via users#index (as needed by the Sharing tab).
{userA} can_read {groupG} can_manage {userB} userA can read anything userB can read.

Implementation

  • When generating the permissions graph in user.rb, follow only the permission links whose head_uuid is a group uuid or whose permission name is "can_manage".
  • The test cases involving "rominiadmin" might still work unmodified: the testusergroup_can_manage_active_user link has can_manage permission.
  • Add test cases to demonstrate the new behavior, perhaps
    • new link: testusergroup can_read spectator
    • test: miniadmin user cannot read the owned_by_spectator specimen
    • test: miniadmin user can get the spectator user record via index and get
    • test: active user cannot get the spectator user record

Files

Screenshot_from_2014-08-24_23_59_08.png (105 KB) Screenshot_from_2014-08-24_23_59_08.png Tom Clegg, 08/25/2014 12:00 AM

Subtasks 6 (0 open — 6 closed)

Task #3563: Write testsResolvedTom Clegg08/20/2014Actions
Task #3562: Change permission modelResolvedTom Clegg08/21/2014Actions
Task #3653: Review 3171-group-membershipResolvedTom Clegg08/20/2014Actions
Task #3564: Design appropriate "join group" interfaceResolvedTom Clegg08/22/2014Actions
Task #3565: Implement admin "add user to group" and "create/rename groups" interfaceResolvedTom Clegg08/23/2014Actions
Task #3665: Review 3171-admin-groupsResolvedPeter Amstutz08/20/2014Actions
Actions
Copy link

Also available in: Atom PDF