Users & permissions

[max-zilla]

(This attempts to describe how permissions and user sharing can work in v2, without getting into technical detail as much as possible)

SCENARIO: Users want 1 Clowder instance to share files across 3 different labs.

• Researchers in each lab sign up for Clowder user account.
• (Optional) Someone at each lab makes a User Group for their lab, and adds the researchers from their lab to it so they can manage permissions collectively
• Datasets are uploaded to Clowder.
  • The initial uploader of the dataset is the Author, and can always see it and edit it.
• Author can assign Roles to the dataset for Users (individual labmates) or User Groups (e.g. list of everyone at the lab)
  • A Role can also be assigned for Public users - typically Viewer or Downloader for example. default is to have no permissions for Public users (private dataset)
  • No one can ever remove the Author's access to the dataset.
• Roles can be created and edited at the instance level, and define some set of permissions (e.g. View, Download, Upload, Update, Add Metadata, Delete...)
• The labs can selectively assigned the other lab user groups Roles in their datasets if they want to share them.
  • Files do not have individual permissions, but Clowder can generate a Share link that will allow direct download of files without authentication.

BONUS DISCUSSION: Collections

• Users can create their own custom Collections of datasets (basically a named list) but Collections are do not have permissions or metadata, they are just informal data collections.
• Collections are only visible to the author by default, but the author can grant View and Edit permissions to other Users or Groups. This only applies to viewing or editing the Collection itself - contents of the collection are still subject to normal permissions requirements!
  • Is this too burdensome? An alternative would be to just have a PUBLIC/PRIVATE checkbox for the collection.
• Allow bulk operations on datasets in a collection - Assign Roles to all of them at once, for example.

[max-zilla]

When creating a dataset, would also be convenient to suggest a few Recently Used Roles/User Groups or something along those lines? So if you are uploading 5, it is easy to upload & share them all the same way?

[ddey2]

I have a few queries, it could be that I am missing some context here. Please guide me in that case.

1. How is Collection different from dataset? Do we need Collection when we have dataset?
2. Let's say a Dataset A has list of files and the author of the dataset has given the users of the dataset 'View' permission only. Is it then ethical to share a downloadable link with those users?
3. Regarding 2nd point in Bonus discussion, I think the suggestion you made to make it just PUBLIC/PRIVATE is more straightforward to understand.

[longshuicy]

1. Where/how do the elasticsearch get authorization information?
2. What backend support needed for frontend to just list resources. i.e. View datasets, view list of files, view list of extraction histories that associate with files
3. Do we differentiate 404 and 403 response

[longshuicy]

[ddey2]

Issues for March 2nd sprint (needed to be discussed and confirmed):

1. Adding group to Authorization table in mongo (when to create a group or add an entry to auth table?)
2. Store info user and group role info in elasticsearch (need to decide when and how)
3. Create mongo view of DS, Auth, User/Group to get list of users authorized to view/edit a particular dataset