Basic Namespace Role CRUD #3

New issue

Closed

opened 2025-11-18 08:09:18 -06:00 by digimint · 1 comment

digimint commented

2025-11-18 08:09:18 -06:00

Owner

A user should be able to create a new role in any namespace in which they are permitted to do so
A user should be able to edit the name of roles with lower priority than their own if they have the EDIT_ROLES permission
A user should be able to allow, deny, or clear any permission they have for any role with lower priority than their own if they also have the EDIT_ROLES permission
A user should be able to re-prioritize roles with lower priority than their own if they have the EDIT_ROLES permission
A user should be able to add or remove roles with lower priority than their own to other users if they have the EDIT_ROLES permission
A user should be able to delete roles with lower priority than their own if they have the EDIT_ROLES permission

Caveats

A user should not be able to remove a role from themselves or remove permissions from a role if it would result in no user having ADMINISTRATE permissions on the namespace.
If the only user with ADMINISTRATE permission on a namespace leaves that namespace, then they must choose another user to grant the ADMINISTRATE permission to.

- [x] A user should be able to create a new role in any namespace in which they are permitted to do so - [x] A user should be able to edit the name of roles with lower priority than their own if they have the `EDIT_ROLES` permission - [x] A user should be able to allow, deny, or clear any permission they have for any role with lower priority than their own if they also have the `EDIT_ROLES` permission - [x] A user should be able to re-prioritize roles with lower priority than their own if they have the `EDIT_ROLES` permission - [x] A user should be able to add or remove roles with lower priority than their own to other users if they have the `EDIT_ROLES` permission - [x] A user should be able to delete roles with lower priority than their own if they have the `EDIT_ROLES` permission ## Caveats - [ ] A user **should not** be able to remove a role from themselves or remove permissions from a role if it would result in no user having `ADMINISTRATE` permissions on the namespace. - [ ] If the only user with `ADMINISTRATE` permission on a namespace leaves that namespace, then they must choose another user to grant the `ADMINISTRATE` permission to.