Access Control Policies

[k-allagbe]

Context

We want our application to uses a combination of roles and permissions to manage access
control. This system would allows us to attribute specific roles to users, which
define their access to various features of the application. Additionally,
permissions are used to manage access to user-owned resources (Discretionary
access control).

Roles

Roles are used to define the overall access level of a user within the
application. The roles are stored in the roles table and include the following:

• dev: Developers with full access to all features.
• admin: Administrators with full access to all features except the dev
  menu.
• team leader: Users with elevated privileges to manage teams (groups).
• inspector: Users with limited access.

Permissions

Permissions are used to manage access to user-owned resources called containers.
A user can manage who can see and upload content into their container. The
permissions are stored in the permission table and include the following:

• read: Permission to view content in a container.
• write: Permission to upload/delete content to a container.
• owner: Full control over the container, including managing permissions for
  other users.

Desired Outcome

• Ensure the system is flexible enough to accommodate future role changes.
• Allow user to control who can view, edit and manage their inspections data (Discretionary
  access control)
• Introduce a RBAC to allow dev to restrict user's access to certain features

Tasks

Frontend

• User interface to manage your resources (Groups, Container permissions,etc)
• Allow user to select which resource they want to upload their data into (which container/folder)
• Allow dev [and admin?] to switch between a regular user mode and their elevated privileges

Backend

• Use the datastore provided structure to upload content into the Storage
• Ensure a flexible and robust workflow to parse and select the user resources
• Handle the business logic regarding the Roles and permissions of users with the provided controllers

Datastore

• Offer Controllers for the relevant entites (User,Group, Container)
• Ensure the permissions are working and the resources are secure

Infra

• Ensure the dev have a User account with dev permissions
• Ensure the data scientists have a dev account and can access user resources/data for training purposes

[Francois-Werbrouck]

I'd rename the Epic "Access control policies" since it isn't only a role base access control