Re: prevent changing Status for new issues

In message <[email protected]>,
Stuart McGraw writes:
>On 10/05/2014 12:11 PM, John P. Rouillard wrote:
>> In message <[email protected]>, Stuart McGraw writes:
>>>I'm having trouble configuring Roundup.
>>>
>>>I am working from the "devel" template and thus have User and Developer
>>>roles (in addition to others).
>>>
>>>I want Users, when creating a new issue or editing an existing one,
>>>not to be able to change the status or resolution fields.  When a new
>>>issue is created, I want status to automatically be assigned 1/new
>>>and not changeable when editing existing issues. 
>> 
>> This should be done with an auditor, not as part of the interface.
>
>Yes, I am using the statusauditor.py detector that comes with
>Roundup.

Good.

>>>I think I am misunderstanding how permissions work.
>> 
>> IIRC, and I am sure somebody will correct me if I am wrong, these
>> permissions work on the class/object.
>> 
>> So by deleting Create permissions for status and resolution, you
>> prevent people (in the User role) from creating new status entries or
>> new resolution entries.
>
>Which I thought was the right thing to do.  Without the ability
>to create a status item, it can only get created by the actions 
>of an auditor, yes?  Which seemed like what I want.

You aren't creating a status item from the issue. You are linking to
an already existing status item.

E.G. Status is one of "New", "Open", "Testing", "Closed" The create
permission on status allows somebody to create a new status
"Broken". It doesn't affect the ability of somebody to set the status
link in the issue.

Clearer?

>To make a long (all day) story short, I ended up making the 
>following changes, the first being key and all basically from
>your suggestions:
>
>for cl in ('priority', 'status', 'resolution',
>-           'issue_type', 'issue', 'file', 'msg'):
>+           'issue_type',          'file', 'msg'):
>     db.security.addPermissionToRole('User', 'Create', cl)
>[...] 
>p = db.security.addPermission(name='Create', klass='issue',
>-                              properties=('title', 'issue_type','messages', 'files', 'nosy'),
>+                              properties=('title', 'type', 'priority','messages', 'files', 'nosy'),
>                               description='User can report and discuss issues')
> db.security.addPermissionToRole('User', p)
> p = db.security.addPermission(name='Edit', klass='issue',
>-                              properties=('title', 'issue_type','messages', 'files', 'nosy'),
>+                              properties=('title','messages', 'files', 'nosy'),
>                               description='User can report and discuss issues')
> db.security.addPermissionToRole('User', p)


Adding explicit View (rather than assuming Edit covers it), and Create
for the issue to the User role sounds right.

>Yes, there seems to be more to permissions than it seemed on first 
>reading of the docs.
>
>Although things seem to be working now as I want, I can't say that 
>I really understand why.  For example, I don't get the distinction 
>between 
>
>   db.security.addPermissionToRole('User', 'Create', 'status')
>
>and 
>
>  p=db.security.addPermission(name='Create', klass='issue', properties=('status',...))
>  db.security.addPermissionToRole('User', p)
>
>Are they both needed?  What happens if I do one but not the  other?  
>Does one take priority over the other?  I gather they have different 
>effects but I'm not sure what.


Does my explanation above clear this distinction up for you? If you use:

  db.security.addPermissionToRole('User', 'Create', 'status')

any User can create a new status object with all its properties.

  p=db.security.addPermission(name='Create', klass='issue',
     properties=('status',...))
  db.security.addPermissionToRole('User', p)

allows the user to create an issue with the listed properties.

--
				-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.

------------------------------------------------------------------------------
Slashdot TV.  Videos for Nerds.  Stuff that Matters.
http://pubads.g.doubleclick.net/gampad/clk?id=160591471&iu=/4140/ostg.clktrk