[Galene] Re: User management

[Jeroen van Veen <jvanveen@protonmail.com>]

Hi Juliusz,

Thanks for explaining! I'll try to keep it simple for now and see if I can allow
basic group management that controls the group files. About the users; I'll try to
add a basic users.json that's controlled by Pyrite, and see how it works.

Cheers,

Jeroen

‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐

Op vrijdag 1 oktober 2021 om 1:55 PM schreef Juliusz Chroboczek <jch@irif.fr>:

> > Any thoughts on a separate users.json that contains entries like:
>
> > [
> >
> > {"name":"jeroen","password":"foobar","groups":{"pyrite":
> >
> > {"op":true,"presenter":true,"other":true}}},
> >
> > {"name":"pyrite","password":"foobar","groups":{}}
> >
> > ]
> >
> > The idea is to be able to set permissions per group, while having only
> >
> > one user entry at a central place.
>
> I'm open to that.
>
> > After modifying users.json, there will be another action from the
> >
> > backend that updates all accompanying group files. As I understand it,
> >
> > there is only 1 administrator user defined in data/passwd? Would it be
> >
> > feasible to have multiple users in there, so each user can have an
> >
> > administrator flag?
>
> I think we should make the data/passwd file obsolete, and define the
>
> administrator role per-user in the users.json file.
>
> > And what would be a good approach to delete or rename a group? Doing
> >
> > a request to the new group name works fine to make it available in the
> >
> > list, but I wonder what will happen to the group that is being
> >
> > renamed/deleted.
>
> The group will exist as long as there are users, but no new users should
>
> be able to login. At least, that's the way the code was written, but
>
> I don't recall if I've tested it.
>
> > Should I use protocol.js in the backend as well to connect to a group
> >
> > and kick all users out, before attempting to rename/delete it?
>
> I don't feel it's necesary, but it's up to you.
>
> > If so, would it be useful to have a 'hidden' user available that can act
> >
> > on behalf of the backend?
>
> No, please no hidden users -- normal users should have full visibility
>
> into what's being done to them. If you need a system user, please make it
>
> visible.
>
> -- Juliusz