Revisit permissions given to our various roles

[benoit74]

These are the various permissions we give by default for every roles we have in the UI:

ROLES = {
    "admin": {
        "tasks": TaskPermissions.get_all(),
        "schedules": SchedulePermissions.get_all(),
        "users": UserPermissions.get_all(),
        "zim": ZimPermissions.get_all(),
    },
    "manager": {
        "tasks": TaskPermissions.get(request=True, unrequest=True, cancel=True),
        "schedules": SchedulePermissions.get(create=True, update=True, delete=True),
        "users": UserPermissions.get(
            read=True, create=True, update=True, delete=True, change_password=True
        ),
    },
    "editor": {"schedules": SchedulePermissions.get(create=True, update=True)},
    "worker": {
        "tasks": TaskPermissions.get(create=True, update=True, cancel=True),
        "zim": ZimPermissions.get(upload=True),
    },
    "processor": {"tasks": TaskPermissions.get(update=True)},
}

I don't get why editor role has not tasks permissions, which basically forces us to grant manager role to persons like Ravan or our Datacup friends so they can request, unrequest and cancel tasks. But at the same time, it given them way too much users permission.

Shall we also add tasks permissions given to manager role to editor role?

[rgaudin]

Ravan and Datacup are too different profile to be used to validate a scenario. Ravan would have request, unrequest and cancel but aliens like Datacup would only have request.
We can create more roles ; those are just aliases for permission sets and do not exist in the DB.

[benoit74]

Does it means that I should only add task.request (manually since it is not possible through the UI) to Datacup for now?

I don't get why person like Ravan can manage users, and why Datacup cannot cancel or unrequest their own tasks.

[rgaudin]

Does it means that I should only add task.request (manually since it is not possible through the UI) to Datacup for now?

No until we got feedback from Datacup confirming that they are using the farm.

I don't get why person like Ravan can manage users, and why Datacup cannot cancel or unrequest their own tasks.

Because there is no segregation between our recipes and aliens-created ones.

[benoit74]

No until we got feedback from Datacup confirming that they are using the farm.

Didn't realized you weren't in CC of the mail where they tell us they do and they have perm issues to start a task ... sorry about that

[rgaudin]

Ah that's good news. New permission in order I believe

[benoit74]

Fixed by #1063