search

archesproject / arches

Arches is a web platform for creating, managing, & visualizing geospatial data. Arches was inspired by the needs of the Cultural Heritage community, particularly the widespread need of organizations to build & manage cultural heritage inventories
GNU Affero General Public License v3.0
211 stars 142 forks source link

Permission groups should have expanded permissions #9626

Open chrabyrd opened 1 year ago

chrabyrd commented 1 year ago

For instance, there is no permission group that will allow a user to view plugins. For a user to view plugins they would need explicit user-level permissions

whatisgalen commented 7 months ago

+1, same goes for letting a user view Graph Editor even if they don't have edit privileges

jacobtylerwalls commented 7 months ago

In Arches for Science we added a data migration to assign plugin access to Resource Reviewers. Maybe others would find this useful?

whatisgalen commented 7 months ago

In Arches for Science we added a data migration to assign plugin access to Resource Reviewers. Maybe others would find this useful?

I think this is a great solution after the fact, but less ideal for prospectively adding new users to an Arches instance since it would have to be run every time, no?

jacobtylerwalls commented 7 months ago

In that PR the permission is assigned to the group, not individuals, so it's resilient against adding new users, as long as your users are given the resource reviewer group :-)

whatisgalen commented 7 months ago

Ah okay thanks for that clarification!

chiatt commented 7 months ago

I think the reason why there is no group to see all plugins is because the use of plugins that an admin might add is unknown and could be sensitive. Admins can always create their own groups and assign plugin access accordingly, or it can be done with an app migration as @jacobtylerwalls pointed out if the app developer wants to grant access it that app's plugins.