rethinking roles (user vs. person)

[vronk]

permission/role is dependent on persons relation to institution and country.
currently role is a attribute of a user.
there needs to be a connection between user and person

[stefanprobst]

to add a bit to this:

currently, user permissions are derived from a role field which lives directly on the user model: a user can have a role of "administrator", "contributor", or "national coordinator" (see https://github.com/DARIAH-ERIC/dariah-knowledge-base/blob/main/prisma/schema.prisma#L625-L629) and this is used for access control: e.g. a "national coordinator" is allowed to approve a report, but a "contributor" is not.

also, the user model currently has a relation to a country, to be able to know what reports by which country a user with role "contributor" or "national coordinator" is allowed to view and edit.

now, we need to add additional roles and permissions for working groups. one approach would be to keep adding fields to the user model: adding "working group member" and "working group chair" to the possible user.role field, and storing workingGroupId on an additional field on the user model.

there are two issues with this approach:

• admins will want to assign persons, not users to working groups, and not every person which should be e.g. marked as a member of a working group will necessarily also have a user account. so permissions should ideally be derived from a person, not a user. not every person needs to be connected to a user, but every user account should be connected to a person, and user permissions should be derived from the roles a person has. this requires clarification how we want to treat "country user" accounts: currently, we don't have user accounts with "contributor" role for individuals, but for whole national consortia (countries): i.e. a "austria" user.
• adding new roles for working groups on the user runs into the additional issue that we need to be able to express that a particular user may be a "member" in one working group, and at the same time a "chair" in a different working group. this would make the role an attribute ob a join table between user and workingGroup. it would be good to model all permissions like this. this would also involve rethinking the bodies and roles tables we currently have: bodies and roles currently mostly map to each other (e.g. a "scientific board" body maps to a "scientific board member" role), however this is not true for the current "wg member" and "wg chair" roles, which don't relate to neither bodies, nor workingGroup tables.

complications:

• person does not directly relate to country. that relation is mediated through instititions (which can be related to more than one country): person<=>institutions<=>country.

[vronk]

thanks for the comments, @stefanprobst.
Can I conclude that we agree that we want to solve this (permissions) systematically through connecting users to persons and their roles?

[stefanprobst]

yes, as good as possible. unfortunately (iirc) we will need to keep a country field on the user model, because we cannot derive a single country affiliation from a person, and because we have "country user accounts" (which sign in with a country@dariah.eu email alias), which are not connected to a person. these would fall back to a default "contributor" role.