Project Level Access Control

============================

Till release 2.12, pagure had a very simple user model. If we added a new

user or a new group to a project, the user/group would be an admin of the project.

The user/group  could do everything from changing the status of an issue to adding

or removing any user on the project. With project ACL feature, we allow a more fine

grained control over what a new user/group has access to, what things it can add or

what actions it can take.

With Project ACL feature, We can now have three levels of access:

* Ticket: A user or a group with this level of access can only edit metadata

  of an issue. This includes changing the status of an issue, adding/removing

  tags from them, adding/removing assignees and every other option which can

  be accessed when you click "Edit Metadata" button in an issue page. However,

  this user can not "create" a new tag or "delete" an existing tag because,

  that would involve access to settings page of the project which this user

  won't have. It also won't be able to "delete" the issue because, it falls

  outside of "Edit Metadata".

* Commit: A user or a group with this level of access can do everything what

  a user/group with ticket access can do + it can do everything on the project

  which doesn't include access to settings page. It can "Edit Metadata" of an issue

  just like a user with ticket access would do, can merge a pull request, can push

  to the main repository directly, delete an issue, cancel a pull request etc.

* Admin: The user/group with this access has access to everything on the project.

  All the "users" of the project that have been added till now are having this access.

  They can change the settings of the project, add/remove users/groups on the project.

Add/Update Access

=================

* Everytime you add a new user or a new group to the project, you will be asked to

  provide the level of access you want to give to that user or group. It's a required

  field in the form.

* To add a user or a group to a project, go to settings page of the project. There are

  buttons with text: *Add User* and *Add Group*. It will take you to a different page where

  you will have to select the user or group (depending on whether you clicked Add User

  or Add Group) and the access you want the user/group to have.

* If you want to update a user or a group's access, go to settings page of the project.

  There is a section which lists users associated with the project with the buttons to edit their

  access and a different button to remove them from the project. If you click the edit

  button, you will be taken to a different page where you can change the access and then

  click on Update button.

Points to be noted

==================

* The creator of a project in pagure holds a more unique position than a normal user

  with admin access. The creator can not be removed by an admin. His access level

  can not be changed. But, an admin's access can be updated by a fellow admin

  or the creator himself.

* All the members of a group will have same access over the project except for the case

  mentioned in the next point.

* In cases when, a user is added to a project with an access level of "A" and a group

  is also added to the same project with access level "B" and that user is also present

  in the group then, the user will enjoy the access of higher of "A" and "B". Meaning,

  if the user earlier had access of ticket and the group had access of commit, the user

  will enjoy the access of a committer. And, if the user earlier had access of commit and

  the group had access of ticket, the user will still be a committer.