search

microsoft / vsts-extension-retrospectives

An Azure DevOps extension for efficient retrospectives
MIT License
183 stars 82 forks source link

No Security Permissions for Retro Boards #5

Closed chrisbatchler closed 9 months ago

chrisbatchler commented 4 years ago

All Project users/teams can view the Retrospectives.

Our team's retros are a safe place to raise issues encountered during sprints and it is not desirable that this feedback could be viewed by other users outside of the Scrum team.

mpth commented 4 years ago

Unfortunately this is technically impossible while the Azure DevOps internal extension data storage is used.

All users in the project collection allways have full read and write access.

https://docs.microsoft.com/en-us/azure/devops/extend/develop/data-storage?view=azure-devops#how-you-can-scope-data

vvyas2 commented 3 years ago

I concur if there is a way to add security to retrospectives (ignoring the collection admin), it might be helpful. e.g. How individual repos/pipelines can be denied permissions.

dieselart commented 2 years ago

Unfortunately this is technically impossible while the Azure DevOps internal extension data storage is used.

All users in the project collection allways have full read and write access.

https://docs.microsoft.com/en-us/azure/devops/extend/develop/data-storage?view=azure-devops#how-you-can-scope-data

The main task in this case is to limit the visibility of the "Retrospectives" section to certain groups of users or specified teams.

In our project, the Customer (Stakeholder) is connected to ADO and can see everything, including the retrospective boards, which is highly undesirable, since commercial information can also be discussed in the retrospective.

I guess half of the teams have a similar problem.

There is no direct solution based on showing / hiding the "Retrospectives" section due to the way the extensions are implemented. However, there is a workaround that will allow you to customize access (but not visibility) to a section for specific teams.

To implement it, you need:

  1. Add an administration hub for this extension.
  2. On the hub page, implement the ability to configure the visibility of the content of the section page in the context of "team <-> project" (many-to-many).
  3. Add a retrospectives section accessibility check for a specific team on a specific project in the Retrospectives hub.
  4. If access is denied, display a stub with some information for the user. Or just display a blank page.