#790129 please add more finegrained user privileges

Package:
src:mini-buildd
Source:
mini-buildd
Submitter:
Marc Haber
Date:
2015-07-01 16:03:23 UTC
Severity:
wishlist
#790129#5
Date:
2015-06-27 13:28:14 UTC
From:
To:
Hi,

when a normal user tries to remove a package from a repository, the
error message is "401 Unauthorized: API: 'remove': Needs superuser
login".

Please consider adding a user permission to do so, so that mini-buildd
can be configured so that normal users can remove packages.

Greetings
Marc
#790129#10
Date:
2015-06-27 14:31:54 UTC
From:
To:
Hi Marc,

On Sa, 2015-06-27 at 15:28 +0200, Marc Haber wrote:
(..)

you can already achieve this by giving a normal user the "superuser"
flag (via the django admin interface).

There is also the "staff" status, giving a user some more rights -- but
not to remove packages. I actually deliberately moved that from 'staff'
to 'superuser' in 1.0.4, as removing packages is (hardly needed) and
potentially dangerous.

Hth!

S
#790129#15
Date:
2015-06-27 15:54:53 UTC
From:
To:
Yes, but that would give the user many more privileges. I currently
cannot explain why, but my feeling says that this shuld be granularily
grantable.

Greetings
Marc
#790129#20
Date:
2015-06-27 16:48:57 UTC
From:
To:
On Sa, 2015-06-27 at 17:54 +0200, Marc Haber wrote:
(...)

yes.

Currently, mini-buildd merely uses the django user management as-is, as
it comes for free, using the existing user/staff/superuser flags to have
some privilege handling for the API calls. Not a lot of extra code
needed.

Having a more fine grained "user role concept" is actually on my roadmap

http://mini-buildd.installiert.net/blog/devtodo_201502.html

(at least hidden somewhere there), as this has been discussed before (a
lot more wishes were involved ;).

I.e., this is a bigger dev task with (as of now) unclear scope, and most
likely not coming any time soon.

Let's keep this Debian-documented as wishlist, maybe retitling "Please
add more finegrained user privileges"?

Hth,

S
#790129#25
Date:
2015-06-27 19:11:16 UTC
From:
To:
retitle #790129 please add more finegrained user privileges
thanks

But there are already fine grained privilieges for other API calls?

Greetings
Marc

P.S.: My mini-buildd has just successfully built its first package.
Now I need to import my old 0.9 repository ;-)
#790129#32
Date:
2015-06-30 10:01:14 UTC
From:
To:
Hi Marc,

On Sa, 2015-06-27 at 21:11 +0200, Marc Haber wrote:
(...)

no. The API calls currently have user/staff/superuser thing.

I have already added a patch (will be in 1.0.8) so one can actually see
the "auth level" for each API call -- for both, 'mini-buildd-tool
--help' and in the web interface.

This should make things clearer.

Hth!

S
#790129#37
Date:
2015-07-01 15:59:40 UTC
From:
To:
I must have confused that with the privileges that can be assigend at
Site Administration => Users => <username> => User permissions.

Greetings
Marc