Feature Request: Functionality Restrictions per user/group #340

Issue

When you add a user, regardless of their permissions, they can see all features of the admin such as time logs, milestones, iterations. This has the potential to leak sensitive information when using Windshift as a tenanted system with multiple clients accessing the admin to view work status. I know that #300 resolves the issues around permissions for workspaces, however that Is not the only place that sensitive information could be viewed. For example in the Time & Projects area, the list of organizations is globally exposed when you may not want everyone to be able to see all clients.

Current Behaviour

• Every user can see see all features and some sensitive information in each feature
• Users can see information about workspaces they should be able too
• There is currently no way to turn off visibility of features to users to restrict their user account type

Desired Behaviour

The ability to configure per user or user group what features they can access to help ensure better data security for multi-tenanted setups.

Option 1:

• Be default users can't see features until granted access to that feature unless the feature already filters what the user can see based on workspace permissions, or the information is entirely tied to their user account
• Direct access to features such as time and projects is denied until permissions are applied
• Access must be validated and not just hidden client side

Benefits

This would help make it so that you can invite clients to collaborate on a workspace, but restrict details in the rest of the application that may leak information about other clients and projects and would enhance other permission controls. This would also give better permissions for internal users, where you might not want them accessing specific features