ROI folders and permissions

[pwalczysko]

cc @joshmoore @mtbc Mark has encouraged me to create this issue to serve as a placeholder to figure out the exact permissions on

• ROI folder linking to other folders
• ROIs linking to ROI folders
• images linkiing to ROI folders

The goal here would be to integrate answers to these questions into permissions sheet

Initial opinion of @mtbc is

for now I've been thinking that maybe people can put things in other people's folders only in rw -- so that means that in ra they could put a ROI they draw on someone's image into their own folder but not the image owner's folder! What the security system currently enforces, or what it can be easily tweaked to do, I'm not sure, Josh would know. One complication is that one may also put images in folders so perhaps they can work a bit like datasets. Feel free to create an issue about Folder / ROI permissions, or I can if you prefer; Josh will definitely be involved.

[pwalczysko]

Initial testing using OMERO.insight shows that the linkage of your ROIs on your images to somobody else's folders is possible (i.e. in read-write group or when you are an admin or group owner.). But please note that these have to be YOUR ROIs. If the ROIs belong to Bob, you cannot link them to Alice's folders (even though you should be able to, i.e. admin in read-only, anyone in read-write), neither to Bob's images (Insight reacts with "Error ocurred whilst saving ROIs" and then the measurements tool and the whole image needs to close and reopen before you can continue with drawing new ROIs.

[pwalczysko]

@sbesson and @mtbc are telling me to map first what is possible at the back end, and if there are no bugs or permission surprises, then have a look whether Insight is capable of viewing the structure of Folders and ROIs created at back end without issues.

cc @jburel @dominikl

[mtbc]

:+1: bin/omero obj new FolderRoiLink ... should be a good test of what the back-end permits.

[pwalczysko]

See testing results on https://docs.google.com/spreadsheets/d/1Z2GjSn_6FcCPDKcpcLuG8PQ2nb5m_0ldbZZb1CiWixs/edit#gid=0

[pwalczysko]

https://docs.google.com/spreadsheets/d/1Z2GjSn_6FcCPDKcpcLuG8PQ2nb5m_0ldbZZb1CiWixs/edit#gid=0 shows that we have basically 3 types of errors, all the same workflow:

• have ROIs of others and try to link them to Folders of others

• have the right permissions for linking the ROIs of others with Folders of others, which are

  • Group owner or admin in read-only group ( = error 1)
  • Group owner or admin in read-annotate group ( = error 2)
  • Group owner or admin or normal member of read-write group ( = error 3)

• try to link the ROIs belonging to others to the Folders of others or yourself in Insight

• observe

  • close the Image you are working with (not just the Measurements Tool)
  • continue working, the action did not proceed but no consequences to your other ROIs or Folders have occurred
  • the linkage of ROIs to Folders in the three situations described above can be achieved on CLI via bin/omero obj new FolderRoiLink parent=Folder:4 child=Roi:31570 (replace the IDs of the Folder and Roi accordingly)
  • the links created on the CLI, although impossible to create in Insight, are well dislplayed and behave in expected way in Insight

[pwalczysko]

cc @hflynn