Re: [Flamerobin-devel] RFC: Privileges page

[Milan B. <mi...@km...>]

Kjell Rilbe wrote:
> Oh, I though there was only one single grant option for each object & 
> user/role. E.g. if user JOE has GRANT OPTION on the table COUNTRY then 
> JOE can modify grants on the table COUNTRY, otherwise not.
> 
> Are you saying it's more fine grained - that JOE could have GRANT OPTION 
> for INSERTs on COUNTRY, but not for DELETEs?

Exactly.

> (I'm disregarding columns 
> here - I assume grants can be set per column, not only per TABLE.)

UPDATE and REFERENCES privilege can be set per column. You can even have 
user that can update some columns and have GRANT OPTION only on some 
columns. In such cases we might expand the table cell and show details, 
OR have an icon for "mixed" grant privileges, and provide the details in 
tooltip, or some messagebox.

>> I think I have a better idea: make a context menu for each checkbox. 
>> Revoke
>> Grant
>> Grant with grant option
>> Grant for selected fields...
>> Show grantor

I would also add:
- Grant all privileges to user (a row)
- Grant all privileges to user (a row) with grant option
- Grant the privilege to all users (a column)
- Grant the privilege to all users (a column) with grant option

- and, of course, revoke option for all that.

When I think of it more, it should not go in context menu, but we can 
rather make links of usernames/privilege names. So, if you click on 
"UPDATE", you get a context menu that says:

- Grant UPDATE to all users
- Grant UPDATE to all users with grant option
- Revoke UPDATE from all users

And if you click on a user (ex. JOE), you get:

- Grant ... to JOE
- Grant ... to JOE with GRANT OPTION
- Revoke ALL from JOE

And if you click the table's first cell (0,0) you get options like:

- grant all to all
- grant all to all with grant option
- revoke all from all

> Grantor as a tooltip sounds nice. Not sure I like the context menu - 
> it's a bit too "hidden". Admittedly, tooltips are also somewhat 
> hidden... Can't figure out a more visible way to display it though.

Have the statusbar text change when user moves a mouse over the 
privilege icon?

> I see. In that case, I'd like a whole batch of SQL to be execute when 
> you accept the grant dialog or apply it (Buttons OK and Apply, 
> respectively). OK and Apply should be gray when nothing's changed, in 
> which case Cancel is the only way out. When something's changed OK and 
> Apply become enabled. If you hit Apply, we're back to the "nothing 
> changed" state.

Good idea. I'm not sure how would we implement it in HTML dialog though. 
It would have to maintain some in-memory state, which is different from 
all other HTML pages which reflect the current state in database.

-- 
Milan Babuskov
http://www.flamerobin.org