Working with Islandora core permissions

[kstapelfeldt]

As currently written, the module allows roles that have the appropriate web annotation permissions to perform CRUD operations on annotations. The only currently required Islandora permission is "View repository objects." This means that, using the Web Annotation model, users can perform CRUD operations on annotations (which are Islandora objects). This means users can "Add datastreams to repository objects, Edit metadata, Create new repository objects, Permanently remove objects from the repository" (language from Islandora core permissions) without having been granted these permissions explicitly. There is a use case for this, as administrators may wish to grant only the option to create web annotations. However, will it cause a problem if we wish to contribute this module to core Islandora? Kirsta to raise -

[kstapelfeldt]

wrote Melissa

[kstapelfeldt]

Kirsta to write Melissa to take this off of committers, and Marcus to follow up with better docs and perhaps touch base with key community members.

[MarcusBarnes]

I've created a separate issue for documenting permissions, since current documentation needs improvement. Once complete, we can use this documentation for gathering community input and possible alternative ways of managing annotation specific permissions.

[kstapelfeldt]

@MarcusBarnes Can we close this issue then?