the-deep / server

Server for DEEP
https://app.thedeep.io/
GNU Affero General Public License v3.0
9 stars 3 forks source link

Create restricted access permission in DEEP admin panel #1487

Open subinasr opened 2 months ago

subinasr commented 2 months ago

Problem Statement

Complete edit access to DEEP Prod admin panel exposes the DEEP database to a lot of vulnerabilities. While a profile attempts to add oneself to a project or a framework for the purpose of investigation of issue, side effects, unintended changes may cause breaking changes to the production database.

Acceptance Criteria

As a user with staff access to admin panel, I should be able to only add/edit the project/framework memberships without changing any other details of the project. As a user with staff access to admin panel, I should be able to view a list of project/framework memberships with ability to search by member and project/framework.

Technical Considerations

Add list of project memberships with ability to add/edit memberships in the admin panel. Remove list of project memberships from project details in admin panel. Remove list of framework memberships from framework details in admin panel.