Libraries MVP Roles and Permissions Investigation and Model Validation

[MaferMazu]

• Stay aligned with all the libraries' roles and permissions we are going to use (Library roles and permissions doc)
• Ensure new authorization model handles all existing use cases. (Migration Plan)

The discussion is based on: https://openedx.atlassian.net/wiki/spaces/OEPM/pages/4840095745/Library+Roles+and+Permissions

[MaferMazu]

@gviedma-aulasneo @jmakowski1123 I would like you to help me with a few questions:

1️⃣ I saw a comment in #53 regarding the roles, and changes in the Library Collaborator; I want to ask: is the Library roles and permissions doc updated with the changes? Are we only changing the name of the library collaborator role, or are there additional changes to consider?

2️⃣ Are we okay with the following grouping of permissions? (Related #51 and #53)

# Library
edit_library
publish_library
view_library
delete_library
manage_library_tags

# Collection 
create_library_collection
edit_library_collection
delete_library_collection

# Team 
manage_library_team
view_library_team

# Content
publish_library_content
reuse_library_content

# Out of MVP
create_library
manage_taxonomies

I asked because that's the grouping based on the current Library roles and permissions doc, but it differs slightly from the Hi-Fi design for the US #51 and #53.

cc @dcoa @bra-i-am

3️⃣ For the policy, we have permission inheritance (edit_library implies view_library). I would appreciate your feedback on the following inheritance rules.

Example with the notation: g2, edit_library, view_library means edit_library implies view_library.

# Library
g2, publish_library, publish_library_content
g2, publish_library_content, edit_library
g2, edit_library, view_library
g2, manage_library_tags, edit_library
g2, delete_library, edit_library

# Content
g2, reuse_library_content, view_library
g2, publish_library_content, view_library

# Team
g2, manage_library_team, view_library_team

# Collections
g2, delete_library_collection, edit_library_collection
g2, edit_library_collection, create_library_collection
g2, edit_library_collection, view_library

[gviedma-aulasneo]

@MaferMazu

1. The doc is updated. Regarding Collaborator, we have a pending discussion with @jmakowski1123 about this role, I will keep the same definition for now.
2. Let me update the doc based on the design, which is the most updated version of the grouping.
3. Library OK - Content OK - Team OK - Collections, this one (g2, edit_library_collection, create_library_collection) is better the other way around (g2, create_library_collection, edit_library_collection)

[MaferMazu]

The doc is updated. Regarding Collaborator, we have a pending discussion with @jmakowski1123 about this role, I will keep the same definition for now.

✅

Let me update the doc based on the design, which is the most updated version of the grouping.

I am a little concerned with this because, for example, in the design, we have a delete_library_content permission, and not a delete_library permission, which differs from the Library roles and permissions doc (because in this doc, the ability to delete_library_content came with the edit_library permission).

In my understanding, the Library roles and permissions doc is our source of truth. And based on that, I get:

	Library Admin	Library Author	Library Collaborator	Library User
Library	view_library edit_library delete_library publish_library manage_library_tags	view_library edit_library x x manage_library_tags	view_library edit_library x x manage_library_tags	view_library x x x x
Content	publish library_content reuse_library_content	publish library_content reuse_library_content	x reuse_library_content	x reuse_library_content
Team	view_library_team manage_library_team	view_library_team x	view_library_team x	view_library_team x
Collections	create_library_collection edit_library_collection delete_library_collection	create_library_collection edit_library_collection delete_library_collection	create_library_collection edit_library_collection delete_library_collection	x x x

I added the table to our document here: https://openedx.atlassian.net/wiki/spaces/OEPM/pages/4840095745/Library+Roles+and+Permissions#Table-of-Roles-and-Permissions. I would really appreciate it if you could review it and, without hesitation, modify it to reflect the actual output we want.

Note: take into account that we can easily say edit_library and delete_library are part of the content. But I am concerned that probably that approach doesn't reflect the reality (because the delete refers to deleting the library, and the edit, well, the edit means a lot of things, but it's over the library)

Library OK - Content OK - Team OK - Collections, this one (g2, edit_library_collection, create_library_collection) is better the other way around (g2, create_library_collection, edit_library_collection)

Thanks ✅. I'll add it to our document as well.

[MaferMazu]

Regarding my concerns, I talked with @gviedma-aulasneo and we agreed to follow the table here: https://openedx.atlassian.net/wiki/spaces/OEPM/pages/4840095745/Library+Roles+and+Permissions#Table-of-Roles-and-Permissions

[MaferMazu]

• Stay aligned with all the libraries' roles and permissions we are going to use (Library roles and permissions doc)
• Ensure new authorization model handles all existing use cases. (Migration Plan)

@jmakowski1123 @gviedma-aulasneo I'll wait a few days, but I think we can close this issue by taking into account that we have new roles and permissions and maps with the previous system.

Please let me know if you have any additional information to share.