Support "universal" permission grants

[slifty]

We have the concept of user permissions and user group permissions, but what if someone wants to grant a type of permission to ALL users?

We need to support this for the planned implementation of #1677 but there are other possible use cases (e.g. a changemaker wants to allow anybody to view a given proposal's data).

[bickelj]

I assume this means all authenticated users. Or is it "make it public"?

[slifty]

Some ways I think this could be done:

• New category of tables e.g. "universal_changemaker_permissions".
• A magic "universal" user group <-- ick
• Some kind of other magic (e.g. null user is universal) <-- ick

In the spirit of "explicit + verbose is the way I think that universal_*_permissions is the most self-documenting and clear.

---

In terms of API design for a moment I thought maybe we should move everything permission-related under an /accessGrants route prefix, but for now I think it's best to keep it simple and just create a new /universalAccessGrants/* set of routes and leave the existing ones as written.

So this would mean new endpoints that look like

• /universalAccessGrants/changemakers/{changemakerId}/permission/{permission}

[slifty]

I assume this means all authenticated users. Or is it "make it public"?

Good question. For the purposes of #1677 the need is related to content creation so it would require a user context, but there are certain other permissions (specifically view) that don't inherently require an authentication session, just establishment of the permission somehow...

Maybe we can start with "it's still an auth-session based access grant, it's just a grant applied to all auth-sessions".

So basically the original issue should read "ALL authenticated users"

@kfogel @jmergy does this sound right? Do we want to support the ability of granting permissions to non-authenticated users as part of this issue (keeping in mind any write-based permission will certainly require an authentication session)