User privileges needs to be modeled some way for both users schema and the web UI.
The plan is to initially assign a 32-bit integer per user that has a bit for each controllable privilege that we want to control per user. An admin user would have all these 32-bits set. A normal user would have only a small subset of these bits set.
Specification (see comments for further fields):
Bit | Default | Description ----+---------+---------------------------- 0 | 0 | Allow to create new users 1 | 0 | Allow to edit other users 2 | 1 | Allow to edit wiki pages 3 | 1 | Allow delegation of other people's tasks 4 | 1 | Allow modification of other people's tasks
Comment #1
Posted on Dec 6, 2007 by Happy Lion(No comment was entered for this change.)
Comment #2
Posted on Dec 6, 2007 by Happy LionAs a rule of thumb for reviewing the privileges, a privilege set of all zeros should never be allowed to make any DB modifications.
Comment #3
Posted on Dec 9, 2007 by Happy LionPushing to release 1.1. Current user="admin" check should be fine in the first version. The current implementation will allow for relatively easy addition of more fine-grained access control.
Comment #4
Posted on Dec 31, 2007 by Happy LionPushing yet again to a later release. Not needed yet.
Status: Accepted
Labels:
Type-Enhancement
Priority-Medium
Component-Persistence
Security
Milestone-Release1.2
Component-Logic