Mailing-List: contact bloodhound-dev-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: bloodhound-dev@incubator.apache.org
Received-SPF: neutral (athena.apache.org: local policy)
MIME-Version: 1.0
In-Reply-To: 
 <CAGMZAuPPhjfGx4QgKz_-5udbGncr4PSp-n=xXYO7N0cMkko4jw@mail.gmail.com>
References: 
 <CAGMZAuPPhjfGx4QgKz_-5udbGncr4PSp-n=xXYO7N0cMkko4jw@mail.gmail.com>
Date: Tue, 22 Jan 2013 14:15:30 +0100
Message-ID: 
 <CAHM0gngAMBS8DGYfTc4q5R3rv6A8x6GS1mHLHNEoU3KVQ2davA@mail.gmail.com>
Subject: Re: [BEP-0003] [RFC] Permissions in product scope
From: Andrej Golcov <andrej@digiverse.si>
To: bloodhound-dev@incubator.apache.org
Content-Type: text/plain; charset=ISO-8859-1

> 7. At present components check for TRAC_ADMIN permission explicitly .
> Some checks might be true for product admins but others do not.
How does Trac should know when it is the case? That can be quite
complex and and potentially brings inconsistent behavior.

I have in mind a little different solution that also has some
drawbacks but provides consistent behavior:
 - Site Admin has TRAC_ADMIN permission for parent environment.
 - Product Admin has  TRAC_ADMIN permission for specific product environment.
 - Check TRAC_ADMIN permission in product environment should return
True for Site Admin. IOW, Site admin is also admin for all products.
 - Site Admin UI has it's own url and is executed in parent
environment e.g. http://bla/main/admin - The functionality of the UI
can be quite different from Product Admin UI, e.g. User management
must be part of this UI.
 - Product Admin UI has it's own url and is executed in product
environment  e.g. http://bla/main/productX/admin - Product admin can
assign product specific permissions to user but cannot CRUD users,
change system specific settings.
 - Product environment should protect from changing of system settings
and multi-product instances such as Users. For example, Product Admin
(with TRAC_ADMIN permission on specific product) cannot change DB
connection string. That can be tricky :) I don't yet feel myself
confident enough to say how this can be implemented. May be kind of
black list of system settings?
Comment, please.

Regards, Andrej