Hey!
We talked about authorizations at the hubs meeting today[1], and I'll
try to summarize what I understood from the requirements.
[1]
https://meetbot.fedoraproject.org/fedora-hubs/2017-03-28/hubs-devel.2017-...
- FAS users have groups in FAS itself, and they have roles for these
groups (member / sponsor / admin)
- OIDC provides a way to get the groups of a logged-in user
- the new API that puiterwijk is developing will provide (a way to
request) the roles a user has in a group
- hubs aren't necessarily named after their FAS group, this
association has to be done manually by a site admin (upon creation or
after)
- once that is done, the FAS groups and roles will be used to limit
actions on a hub
- it will be possible to request membership for a hub. Group members
with the sponsor or admin roles will be able to approve or deny it
directly from Hubs
- group admins will be able to set the hub metadata
- a hub can also have a global visibility setting :
* public if anybody can see the content (including not logged-in visitors)
* preview if some information is not accessible to anonymous users,
and the rest is accessible to any logged-in user.
* private if only group members can see the content
In "preview" hubs, choosing which info will be public and which will
be restricted to logged-in users is going to be very tricky. I can
imagine adding a privacy level to widgets, but I don't know how to do
that on data that isn't coming from hubs (like a newsfeed item).
In the meeting there was also talk of reducing the number of visible
items in the feed for "preview" hubs. That will have to be implemented
in the feed widget itself when the hub setting is available.
Also, FAS groups that are not *-git, or ACL-oriented groups will have
a hub created for them (this is likely to be done by a cron job).
I hope I'm not missing something, otherwise please tell me.
Aurélien