Taiga access considerations

[Ben Cotton]

Hi IoTers,

We need to figure out a few things related to how we use Taiga. Users
cannot self-add to groups, so one question we need to figure out is
when we should add people to the project. The answers can range from
"when they ask to be added" to "when they've cleared this bar"
(and
then we'll have to define the bar).

Relatedly, we can modify the ACLs on the board to allow any
authenticated user to create/modify/etc issues and user stories. So
one possibility would be to open it up so that folks can create or
edit cards without joining the project, but further permissions would
be limited.

I would describe Taiga's ACL scheme as "middle-grained". But let's
figure out what the "policy" should look like and then we can adjust
the settings to match that as closely as possible.

-- 
Ben Cotton
He / Him / His
Fedora Program Manager
Red Hat
TZ=America/Indiana/Indianapolis

[Peter Robinson]

On Wed, Jun 5, 2019 at 9:04 PM Ben Cotton <bcotton(a)redhat.com&gt; wrote:
>  Hi IoTers,
>
>  We need to figure out a few things related to how we use Taiga. Users
>  cannot self-add to groups, so one question we need to figure out is
>  when we should add people to the project. The answers can range from
>  "when they ask to be added" to "when they've cleared this bar"
> (and
>  then we'll have to define the bar).
>
>  Relatedly, we can modify the ACLs on the board to allow any
>  authenticated user to create/modify/etc issues and user stories. So
>  one possibility would be to open it up so that folks can create or
>  edit cards without joining the project, but further permissions would
>  be limited. 
I think if they're authenticated, and hence have a FAS account, it
should be quite open. I've tweaked this and opened it up quite a bit,
feedback welcome.

> I would describe Taiga's ACL scheme as "middle-grained". But let's
> figure out what the "policy" should look like and then we can adjust
> the settings to match that as closely as possible.
>
> --
> Ben Cotton
> He / Him / His
> Fedora Program Manager
> Red Hat
> TZ=America/Indiana/Indianapolis
> _______________________________________________
> IoT mailing list -- iot(a)lists.fedoraproject.org
> To unsubscribe send an email to iot-leave(a)lists.fedoraproject.org
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
https://lists.fedoraproject.org/archives/list/[e-mail]

[Ben Cotton]

On Wed, Jun 19, 2019 at 7:15 AM Peter Robinson <pbrobinson(a)gmail.com&gt; wrote:
>  I think if they're authenticated, and hence have a FAS account, it
>  should be quite open. I've tweaked this and opened it up quite a bit,
>  feedback welcome.
>  
I agree. I did notice that "external users" were able to delete wiki
pages and links, and I removed that permission.

The only thing that's not clear to me is what the intent of the
different roles are, especially since they seem to have identical or
near-identical permissions. It might more sense to just have
"developer" or "team member" or whatever and if we find a need to
change it as we go, then we can split more roles out. Or do you just
mean to use it as a way of indicating areas of expertise for people?

-- 
Ben Cotton
He / Him / His
Fedora Program Manager
Red Hat
TZ=America/Indiana/Indianapolis

[Peter Robinson]

On Wed, Jun 19, 2019 at 9:30 PM Ben Cotton <bcotton(a)redhat.com&gt; wrote:
>  On Wed, Jun 19, 2019 at 7:15 AM Peter Robinson <pbrobinson(a)gmail.com&gt; wrote:
>  >
>  > I think if they're authenticated, and hence have a FAS account, it
>  > should be quite open. I've tweaked this and opened it up quite a bit,
>  > feedback welcome.
>  >
>  I agree. I did notice that "external users" were able to delete wiki
>  pages and links, and I removed that permission.
>
>  The only thing that's not clear to me is what the intent of the
>  different roles are, especially since they seem to have identical or
>  near-identical permissions. It might more sense to just have
>  "developer" or "team member" or whatever and if we find a need to
>  change it as we go, then we can split more roles out. Or do you just
>  mean to use it as a way of indicating areas of expertise for people? 
Yes, I agree with that. I was trying to work out my thinking when I
was reviewing bits the other day and I don't remember so ¯\_(ツ)_/¯
I'll review and collapse them down in the next few days.

Peter