[WIP] Decoupling user email from role name #18966
Draft
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
jdavcs
added
kind/enhancement
area/API
area/admin
area/database
jdavcs
force-pushed
the
dev_private_roles2
branch
from
62d6876
to
4e35f14
Compare
Because we no longer can match role name to user email
Now that role name doesn't have to be unique, we don't want to pass args like "private role" or "shared role" on role creation.
Reason: decouple user email from private role naming: emails can be
changed or redacted; user id in user-role-association + role type is
sufficient to tie a user to a private role.
The description (i.e., "this is a private role for a user" is inferrable
from the role name ("private role"), which is assigned by default.
Reasons: not needed, query is ambiguos after decoupling user emails from role names
- Add user email to represent user's private role - Exclude generic role names
jdavcs
force-pushed
the
dev_private_roles2
branch
from
4e35f14
to
84a30a2
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Draft.
Notes:
This adds a new API endpoint for retrieving user roles (currently used to retrieve a user's private role, which is no longer possible by retrieving all roles and selecting the one with the name matching the user's email).
The idea is to decouple emails from role names. In this approach, we remove the unique constraint from the
role.namefield in the database, which allows the creation of generic roles like "private role" or "sharing role", which do not depend on a user's email and are identified by their type and a relationship stored in the user_role_association table. However, when an admin user manually creates a role in the admin UI, they will be required to pick a unique role name. Otherwise, an admin may accidentally create duplicate roles with names that are intended to distinguish them from other roles (e.g. we don't want multiple role names like "Foo lab").TODO:
How to test the changes?
(Select all options that apply)
License