[Galene] Re: User management

[Juliusz Chroboczek <jch@irif.fr>]

> Any thoughts on a separate users.json that contains entries like:
> 
> [
>     {"name":"jeroen","password":"foobar","groups":{"pyrite":
>         {"op":true,"presenter":true,"other":true}}},
>     {"name":"pyrite","password":"foobar","groups":{}}
> ]
> 
> The idea is to be able to set permissions per group, while having only
> one user entry at a central place.

I'm open to that.

> After modifying users.json, there will be another action from the
> backend that updates all accompanying group files. As I understand it,
> there is only 1 administrator user defined in data/passwd? Would it be
> feasible to have multiple users in there, so each user can have an
> administrator flag?

I think we should make the data/passwd file obsolete, and define the
administrator role per-user in the users.json file.

> And what would be a good approach to delete or rename a group? Doing
> a request to the new group name works fine to make it available in the
> list, but I wonder what will happen to the group that is being
> renamed/deleted.

The group will exist as long as there are users, but no new users should
be able to login.  At least, that's the way the code was written, but
I don't recall if I've tested it.

> Should I use protocol.js in the backend as well to connect to a group
> and kick all users out, before attempting to rename/delete it?

I don't feel it's necesary, but it's up to you.

> If so, would it be useful to have a 'hidden' user available that can act
> on behalf of the backend?

No, please no hidden users -- normal users should have full visibility
into what's being done to them.  If you need a system user, please make it
visible.

-- Juliusz