search

jonlab / NewAtlantis

http://www.newatlantis.world/
9 stars 6 forks source link

User rights management : Assets, Spaces, Objects #9

Open jonlab opened 8 years ago

jonlab commented 8 years ago

We need to improve the user rights in the app : what we could do : -Only an object's owner can modify or delete an object or Space. -A public asset can be turned to an object (==put in a Space) by anyone (but then only that user will be able to modify or delete it. -To be discussed : what if a public object is destroyed by its owner ?

rolandcahen commented 8 years ago

Very important to do as soon as possible. Public objects can be suppressed only if no-one else is using it (warning) New versions of objects replace old ones in all spaces (info if possible)

jonlab commented 8 years ago

What we can do when a public Asset is updated is send a notification email to all users referencing it in a space so they know that the Asset changed.

jonlab commented 8 years ago

I implemented an object ownership check on the PHP server with the following rules : -the owner of an object is defined as the user who created it (even if he/she added a public asset to a Space). -only the owner is able to delete the object. -only the owner is able to modify (change position/rotation in Space) the object.

rolandcahen commented 8 years ago

We have been talking about the right to manage SPACES and OBJECTS and defined 3 levels of rights:

Is there a way to modify all objects of a SPACE if you create it ? If so , would it be possible to share these rights ?

jonlab commented 8 years ago

Ok, but I would say that a User and Visitor is the same thing : a Visitor is just a User visiting another space (that he/she doesn't own). So I would do :

rolandcahen commented 8 years ago

ok. The same kinds of rights should apply to SPACE as well as OBJECTS. The only difference is that other "Users" can contribute to a SPACE if it is public. It is not necessary to implement it now, for we can consider every participant as a User, but sometime, a SPACE should be visitable by everyone but only editable by a list of Users.