Horizontal access control (ACLs)

[CedricReichenbach]

Currently, users have complete horizontal access to all data matching their role (vertical restriction).

Access control lists (ACLs) should define which user has access to what data. Some particular examples:

• Researchers should only have access to a specific set of studies (and answers thereof).
• Admins (or perhaps another intermediate level) should only be allowed to manage certain users.
• Baseline users should only be able to see questionnaires of studies they're enrolled in.

[CedricReichenbach]

This will need some consideration and possible follow-up work in terms of UI in the app project.

[CedricReichenbach]

Rough draft of design:

Entities to be access-controlled are:

• Studies
• Questionnaires
• Questions
• Users
• Answers

Researchers

This part addresses data with regards to editing, so whatever researchers (and admins) see and manipulate on the app's editor page.

Owner

Each of above entities has one or more owners. An owner is a user with the ability to edit access control to said entities (besides full edit access).

Edit access

Each entity has a set of editors who can see and edit them, but not alter access control.

Read access

Each entity has a set of users with read access. This is relevant e.g. for cloning items.

Base users

For base users, i.e. participants, access control should not be explicitly managed through ACLs, but rather implicitly based on data relations, like study participation and answer submissions.

• Participants should be able to see all entities relevant for listing questions aimed at them.
• Each participant should have read access to their answers. (TODO: Debatable)

[CedricReichenbach]

Simplified version

Let's keep it simple for starters.

• Manage researcher access to studies only; derive everything from there.
  • What about disconnected entities (e.g. questionnaire without study)?
• Base users get implied read rights based on membership.
• Admins can see and edit everything.

How to handle ACLs on users, e.g. generating a password reset token or deleting another user? Perhaps we still need some kind of explicit ACLs on users.

[CedricReichenbach]

App follow-up issue: https://github.com/upkbs-chronobiology/somnus-app/issues/77