Actions
User Story #288
open
Epic #49: Implement user, groups and permissions management
Feature #268: Granting access
As an operator, I want nobody to be able to hand out access they do not hold, so that managing access cannot be used to become an administrator
User Story #288:
As an operator, I want nobody to be able to hand out access they do not hold, so that managing access cannot be used to become an administrator
Start date:
Due date:
% Done:
0%
Estimated time:
Description
If being allowed to manage access were enough by itself, anyone with it could give themselves or a friend the Administrator role. Handing out access therefore requires holding it.
Acceptance criteria
- Giving access requires both the right to manage access and holding everything being given
- A refusal names which capability was missing
- Holding a whole family of capabilities satisfies the check for any of them
- The rule applies to platform-wide grants, object grants and denials alike
- The interface does not offer roles the person could not give
Rejection reason
Superseded by the rewritten epic #49
Updated by
Actions