Organization Teams and Roles (RBAC)

[sgotti]

This issue is a placeholder to describe how org teams and roles will be implemented.

Organization Teams

• Teams are a group of user
• Teams will be a hierarchical. Child teams will inherit users and permissions from parent teams
• Every team will have permissions to projects/projectgroups in the form of Roles

Roles (RBAC)

• A role is a group of permitted actions on specific (project/projectgroup)
• An action is mapped 1to1 to a gateway api action
• A group of predefined roles (owner, authorizer etc...) will be provided by default
• In future there could be the possibility to define custom roles

Open questions

A special case is Task authorization. We'd like to be able to let some user authorize only some tasks in a Run (i.e. some user can authorize a deployment to a testing environment while only some other users can authorize the deployment to production). This will require the ability to describe how a role can be applied only to a specific task "selector" (task name, regexp etc...)

[huapox]

Great, there be lots todo with ui for pc/mobile and user-friendly entries/docs.

[sgotti]

Just as an update that work on this is going on. I hope to be able to open initial PRs (after #191) that adds teams (with member and projects) to configstore and gateway, the authorization logic in the gateway, the related agola cli commands and many tests.