Project Level Access Control
Till release 2.12, pagure had a very simple user model. If we added a new
user or a new group to a project, the user/group would be an admin of the project.
The user/group could do everything from changing the status of an issue to adding
or removing any user on the project. With project ACL feature, we allow a more fine
grained control over what a new user/group has access to, what things it can add or
what actions it can take.
With Project ACL feature, We can now have three levels of access:
- Ticket: A user or a group with this level of access can only edit metadata
of an issue. This includes changing the status of an issue, adding/removing
tags from them, adding/removing assignees and every other option which can
be accessed when you click "Edit Metadata" button in an issue page. However,
this user can not "create" a new tag or "delete" an existing tag because,
that would involve access to settings page of the project which this user
won't have. It also won't be able to "delete" the issue because, it falls
outside of "Edit Metadata".
- Commit: A user or a group with this level of access can do everything what
a user/group with ticket access can do + it can do everything on the project
which doesn't include access to settings page. It can "Edit Metadata" of an issue
just like a user with ticket access would do, can merge a pull request, can push
to the main repository directly, delete an issue, cancel a pull request etc.
- Admin: The user/group with this access has access to everything on the project.
All the "users" of the project that have been added till now are having this access.
They can change the settings of the project, add/remove users/groups on the project.
Add/Update Access
- Every time you add a new user or a new group to the project, you will be asked to
provide the level of access you want to give to that user or group. It's a required
field in the form.
- To add a user or a group to a project, go to settings page of the project. There are
buttons with text: Add User and Add Group. It will take you to a different page where
you will have to select the user or group (depending on whether you clicked Add User
or Add Group) and the access you want the user/group to have.
- If you want to update a user or a group's access, go to settings page of the project.
There is a section which lists users associated with the project with the buttons to edit their
access and a different button to remove them from the project. If you click the edit
button, you will be taken to a different page where you can change the access and then
click on Update button.
Points to be noted
- The creator of a project in pagure holds a more unique position than a normal user
with admin access. The creator can not be removed by an admin. His access level
can not be changed. But, an admin's access can be updated by a fellow admin
or the creator himself.
- All the members of a group will have same access over the project except for the case
mentioned in the next point.
- In cases when, a user is added to a project with an access level of "A" and a group
is also added to the same project with access level "B" and that user is also present
in the group then, the user will enjoy the access of higher of "A" and "B". Meaning,
if the user earlier had access of ticket and the group had access of commit, the user
will enjoy the access of a committer. And, if the user earlier had access of commit and
the group had access of ticket, the user will still be a committer.