Re: [phpBT-dev] User Permission Levels

[Benjamin C. <php...@be...>]

Ulf Erikson wrote:
> Hoi,
> 
> I have implemented different permissions for users and developers when 
> they are the reporter/owner of a bug and not. For instance, I allow 
> comments from anyone who is logged in. Managers and project leaders may 
> change almost everything at any time, users and developers only when 
> they are reporter or owner of a bug. The severity is for the reporter 
> only and the priority is for the owner only. (BTW, I have split your 
> severity into report type and severity)

This works for me, except the priority part.  Very often a reporter 
might want to change the priority of a bug (in organizations where the 
developer doesn't have as much determination about which bugs get 
addressed first).  Perhaps we could have a list of permissions assigned 
to roles (in addition to -- or maybe in replacement of -- groups).  That 
way you could have a reporter role, and an owner role, and a 
"third-party" role, and each of these could be assigned particular 
permissions (like EditAssignemt, EditPriority, etc.) as desired.  So, 
basically, users could change roles per bug, but they could have a 
different set of permissions by virtue of their group memberships on a 
more general basis (users in the QA group would always have CloseBug 
permission, regardless of reporter/owner/witness role).  We'd have to 
decide how to handle conflicts between group permissions and role 
permissions. :)

> 
> Now, there is a huge number of requests for all sorts of permission 
> levels in the trackers. My implementation is good enough for me, but the 
> way the new rules are enforced wouldn't attract everyone. I would be 
> willing to try make my implementation general enough to satisfy other 
> peoples needs as well, *if* there can be some discussion on what people 
> actually want and how this can be achieved. The current silence isn't 
> very encouraging..
> 
> What kind of user levels would you like to have? By what granularity? 
> How would you like to be able to configure this (I'm thinking of my 
> earlier group permission editor, but that wouldn't scale too well with 
> an increasing number of permission flags..)? The more ideas the better. 
> The more detailed descriptions on how to operate this the more likely 
> that it might happen..

I haven't had a chance to apply your permission editor patch, so I don't 
know what the UI is, but I could see a page with each Role or Group 
listed, beneath each being a grid of checkboxes with the permission 
names as labels.

> 
> Here are some of the reports I have found that seem related. If you know 
> more please post those links as well. It should be possible to find a 
> solution general enough to be applied to all/most of these issues. 
> Anyone willing to help find it?
> 
> 
> User Permission Levels
> http://sourceforge.net/tracker/index.php?func=detail&aid=829858&group_id=14939&atid=364939 
> 
> 
> Project Admin cannot change assignments
> http://sourceforge.net/tracker/index.php?func=detail&aid=1060247&group_id=14939&atid=114939 
> 
> 
> Managers Cannot Change Bug Details
> http://sourceforge.net/tracker/index.php?func=detail&aid=1017788&group_id=14939&atid=114939 
> 
> 
> Stricter editing ?
> http://sourceforge.net/tracker/index.php?func=detail&aid=618641&group_id=14939&atid=364939 
> 
> 
> Guest login
> http://sourceforge.net/tracker/index.php?func=detail&aid=579407&group_id=14939&atid=364939 
> 
> 
> Non-editable fields when not logged in
> http://sourceforge.net/tracker/index.php?func=detail&aid=579849&group_id=14939&atid=364939 
> 

The "Non-editable fields" one is fixed with JavaScript warning a user 
about not making changes when not logged in.  I don't know that this one 
is very permission related.

> 
> New user can set another reporter for bug
> http://sourceforge.net/tracker/index.php?func=detail&aid=1034495&group_id=14939&atid=114939 
> 

This set another reporter bug is one that I'd really like to fix before 
1.0, but I haven't put enough thought yet into what is the best approach.

> 
> How to restrain task assignment only to users at admin group
> http://sourceforge.net/tracker/index.php?func=detail&aid=782962&group_id=14939&atid=114939 
> 
>