From 6bbfba3a8997c0e84c2f73c5ffad8d9b30e971ed Mon Sep 17 00:00:00 2001 From: Vivek Anand Date: Feb 15 2017 10:32:24 +0000 Subject: [PATCH 1/3] Docs: Project ACLs Signed-off-by: Vivek Anand --- diff --git a/doc/usage/project_acls.rst b/doc/usage/project_acls.rst new file mode 100644 index 0000000..329b2b9 --- /dev/null +++ b/doc/usage/project_acls.rst @@ -0,0 +1,64 @@ +Project Level Access Control +============================ + +Till release 2.12, pagure had a very simple user model. If we added a new +user or a new group to a project, the user/group would be an admin of the project. +The user/group could do everything from changing the status of an issue to adding +or removing any user on the project. With project ACL feature, we allow a more fine +grained control over what a new user/group has access to, what things it can add or +what actions it can take. + +With Project ACL feature, We can now have three levels of access: + +* Ticket: A user or a group with this level of access can only edit metadata + of an issue. This includes changing the status of an issue, adding/removing + tags from them, adding/removing assignees and every other option which can + be accessed when you click "Edit Metadata" button in an issue page. However, + this user can not "create" a new tag or "delete" an existing tag because, + that would involve access to settings page of the project which this user + won't have. It also won't be able to "delete" the issue because, it falls + outside of "Edit Metadata". + +* Commit: A user or a group with this level of access can do everything what + a user/group with ticket access can do + it can do everything on the project + which doesn't include access to settings page. It can "Edit Metadata" of an issue + just like a user with ticket access would do, can merge a pull request, can push + to the main repository directly, delete an issue, cancel a pull request etc. + +* Admin: The user/group with this access has access to everything on the project. + All the "users" of the project that have been added till now are having this access. + They can change the settings of the project, add/remove users/groups on the project. + +Add/Update Access +================= + +* Everytime you add a new user or a new group to the project, you will be asked to + provide the level of access you want to give to that user or group. It's a required + field in the form. + +* To add a user or a group to a project, go to settings page of the project. There are + buttons with text: *Add User* and *Add Group*. It will take you to a different page where + you will have to select the user or group (depending on whether you clicked Add User + or Add Group) and the access you want the user/group to have. + +* If you want to update a user or a group's access, the procedure remains same as adding + a user/group. Go to settings page of the project, click on *Add User* or *Add Group*, + select the new access level you want the user/group to give and submit. + +Points to be noted +================== + +* The creator of a project in pagure holds a more unique position than a normal user + with admin access. The creator can not be removed by an admin. His access level + can not be changed. But, an admin's access can be updated by a fellow admin + or the creator himself. + +* All the members of a group will have same access over the project except for the case + mentioned in the next point. + +* In cases when, a user is added to a project with an access level of "A" and a group + is also added to the same project with access level "B" and that user is also present + in the group then, the user will enjoy the access of higher of "A" and "B". Meaning, + if the user earlier had access of ticket and the group had access of commit, the user + will enjoy the access of a committer. And, if the user earlier had access of commit and + the group had access of ticket, the user will still be a committer. From 7208b9c34e45639673f2cba9a688a93abb3a4d39 Mon Sep 17 00:00:00 2001 From: Vivek Anand Date: Feb 15 2017 10:32:24 +0000 Subject: [PATCH 2/3] Update the project_acls docs after updating the way to edit a user/group's access Signed-off-by: Vivek Anand --- diff --git a/doc/usage/project_acls.rst b/doc/usage/project_acls.rst index 329b2b9..01f3424 100644 --- a/doc/usage/project_acls.rst +++ b/doc/usage/project_acls.rst @@ -41,9 +41,11 @@ Add/Update Access you will have to select the user or group (depending on whether you clicked Add User or Add Group) and the access you want the user/group to have. -* If you want to update a user or a group's access, the procedure remains same as adding - a user/group. Go to settings page of the project, click on *Add User* or *Add Group*, - select the new access level you want the user/group to give and submit. +* If you want to update a user or a group's access, go to settings page of the project. + There is a section which lists users associated with the project with the buttons to edit their + access and a different button to remove them from the project. If you click the edit + button, you will be taken to a different page where you can change the access and then + click on Update button. Points to be noted ================== From 1fadc069921184f64862394a443ddc5c23afbe49 Mon Sep 17 00:00:00 2001 From: Pierre-Yves Chibon Date: Feb 15 2017 10:34:46 +0000 Subject: [PATCH 3/3] Link to the ACLs documentation --- diff --git a/doc/usage/index.rst b/doc/usage/index.rst index 68d2048..9c5013b 100644 --- a/doc/usage/index.rst +++ b/doc/usage/index.rst @@ -37,6 +37,7 @@ Contents: pull_requests markdown project_settings + project_acls roadmap using_doc using_webhooks