Actions
User Story #290
open
Epic #49: Implement user, groups and permissions management
Feature #269: Access decision and enforcement
As an administrator, I want one predictable answer when several grants apply at once, so that access never depends on the order things were set up in
User Story #290:
As an administrator, I want one predictable answer when several grants apply at once, so that access never depends on the order things were set up in
Start date:
Due date:
% Done:
0%
Estimated time:
Description
A person can be reached by grants from several directions at once: their own, their groups', on the object, and above it. The rules for combining them must be fixed, written down, and the same everywhere.
Acceptance criteria
- The place closest to the object decides; places further away are only consulted when the nearer one says nothing
- Within one place, a grant naming the person outranks one naming a group they belong to
- Within one place, a denial beats an allowance
- Someone holding the Administrator role is allowed before any denial is considered
- Anything left undecided is refused
- Two groups disagreeing in the same place produces a denial, and re-admitting that person is possible by naming them directly
- The rules are covered by tests that include containers above the object, so that folders can later be added without changing them
Rejection reason
Superseded by the rewritten epic #49
Updated by
Actions