User - Organization - Channel Edit/View Permissions

[ArthurMousatov]

❌ This issue is not open for contribution. Visit Contributing guidelines to learn about the contributing process and how to find suitable issues.

Overview

As Organizations and Channels are finally being connected, we need to find a way to merge permissions between these two models. Currently, Channels are owned via the editor property, but once they are part of an organization, channel editors need to include organization editors and admins. This equally applies to viewing permissions, tagged to Channel.viewers.

Complexity: Low
Target branch: unstable

The Change

Whenever the API needs to check for a user's editable/viewable channels, it should consider both personal channel permissions, AND organization channel permissions. In channel context, org admin permissions should translate to editing permissions as well.

Here are a few examples:

Person A is an editor on Channel A, and they have been invited to join Org 1.

Person A should be able to join Org 1 as an Org Viewer, and retain their edit permissions on their own channel
Person A should be able to join Org 1 as an Org Editor, and gain edit permissions for all org-associated channels
Person A should be able to join Org 1 as an Org Admin, and gain edit permissions for all org-associated channels and gain management permissions on the org itself (such as sending invitations to the org, upgrading permissions of others, etc.)

Admin B at Org 1 should have management permissions on the org itself (such as sending invitations to the org, upgrading permissions of others, etc.) as well as edit permissions for all org-associated channels
Org Editor B at Org 1 should have edit permissions for all org-associated channels (for example, although they are not the original creator of Channel A, they can now edit it)
Org Viewer B at Org 1 should be able to see Channel A, but not edit it. They should be able to edit their own created channels within the org, if any.

How to Get There

Whenever the API checks for channel EDIT permissions, or tries to find a user's editable channels. This is usually done via Channel.filter_edit_query_set() or Channel.editors (commonly used as User.editable_channels).

Whenever the API checks for channel VIEW permissions, or tries to find a user's viewable channels. This is usually done via Channel.filter_view_queryset() or Channel.viewers (commonly used as User.view_only_channels).

Acceptance Criteria

Previous Items

• Blocking comment from Feature organization model #6080

ContentNode.filter_edit_queryset (models.py:2373), AssessmentItem (3406), File (3608) route through PermissionCTE.editable_channels (1022) — m2m only, no org branch. /api/sync/ gates on Channel.filter_edit_queryset (sync/endpoint.py:61-67), so org-editor content changes are admitted, then rejected as "Not found" by get_edit_queryset() (base.py:798). Issue requires channels and content. Union the org channel ids into PermissionCTE.editable_channels.

• Blocking comment from Feature organization model #6080

ChannelViewSet.get_queryset (channel.py:518-521) re-annotates edit/view from the m2m tables; annotate() overwrites, discarding these grants. GET /api/channel/ returns edit: false, ?edit=true skips the channel, yet PATCH succeeds via filter_edit_queryset. Drop that re-annotation; fold organization_view/organization_edit into edit/view here.

General

• Channel Edit Querysets now consider edit rights through organization channels/roles
• Usage of User.editable_channels or Channel.editors is replaced with a combination of the original Channel.editors check + organization-wide check
• Channel View Querysets now consider view rights through organization channels/roles
• Usage of User.view_only_channels or Channel.viewers is replaced with a combination of the original Channel.viewers check + organization-wide check

AI usage

AI was used to gather a few code requirements across the code base (usage of edit permissions)

[marcellamaki]

Thanks @ArthurMousatov for updating to include the two blocking items. that looks great ✅

As for the permissions, I think I'd like to add a bit more granularity of the permissions, while keeping the same roles as previously defined. I'll explain this more through the user experience in terms of how I'm thinking about it.

Person A is an editor on Channel A, and they have been invited to join Org 1.

Person A should be able to join Org 1 as an Org Viewer, and retain their edit permissions on their own channel
Person A should be able to join Org 1 as an Org Editor, and gain edit permissions for all org-associated channels
Person A should be able to join Org 1 as an Org Admin, and gain edit permissions for all org-associated channels and gain management permissions on the org itself (such as sending invitations to the org, upgrading permissions of others, etc.)

Admin B at Org 1 should have management permissions on the org itself (such as sending invitations to the org, upgrading permissions of others, etc.) as well as edit permissions for all org-associated channels
Org Editor B at Org 1 should have edit permissions for all org-associated channels (for example, although they are not the original creator of Channel A, they can now edit it)
Org Viewer B at Org 1 should be able to see Channel A, but not edit it. They should be able to edit their own created channels within the org, if any.

This may be what you're suggesting, but I think permissions should be a combination of permissions, not a full inheritance of permissions, if that makes sense. Let me know if you have questions or want to discuss more.

[ArthurMousatov]

Thanks @ArthurMousatov for updating to include the two blocking items. that looks great ✅

As for the permissions, I think I'd like to add a bit more granularity of the permissions, while keeping the same roles as previously defined. I'll explain this more through the user experience in terms of how I'm thinking about it.

Person A is an editor on Channel A, and they have been invited to join Org 1.

Person A should be able to join Org 1 as an Org Viewer, and retain their edit permissions on their own channel Person A should be able to join Org 1 as an Org Editor, and gain edit permissions for all org-associated channels Person A should be able to join Org 1 as an Org Admin, and gain edit permissions for all org-associated channels and gain management permissions on the org itself (such as sending invitations to the org, upgrading permissions of others, etc.)

Admin B at Org 1 should have management permissions on the org itself (such as sending invitations to the org, upgrading permissions of others, etc.) as well as edit permissions for all org-associated channels Org Editor B at Org 1 should have edit permissions for all org-associated channels (for example, although they are not the original creator of Channel A, they can now edit it) Org Viewer B at Org 1 should be able to see Channel A, but not edit it. They should be able to edit their own created channels within the org, if any.

This may be what you're suggesting, but I think permissions should be a combination of permissions, not a full inheritance of permissions, if that makes sense. Let me know if you have questions or want to discuss more.

Fully agree on everything here @marcellamaki - this is essentially what I had in mind. The goal is to keep the same filter functions (view/edit query sets), and just add the extra channels a user has access to from his org roles. This will allow channel editors/viewers to keep their old permissions as well as any new org perms. For this issue, the only two permissions sets that are in scope is view/edit, since admin permissions in a "channel" view are the same as an editor's (we'll just add both admin and edit org roles to the search filter for edit perms).

I will update the issue with your much more detailed description of the scenarios.

[marcellamaki]

great - thank you!

[ArthurMousatov]

great - thank you!

Issue has been updated - rewrote a bit of the change section, and added your scenarios. Let me know if there's anything else you'd like me to change!

[marcellamaki]

looks great, @ArthurMousatov ✅ - ready to be assigned

[ArthurMousatov]

looks great, @ArthurMousatov ✅ - ready to be assigned

Fantastic! Please assign @yasinelmi to this issue

[yasinelmi]

Hi! I can take over this issue.

[learning-equality-bot]

Hi! 👋

Thanks so much for your interest! This issue is not open for contribution. Visit Contributing guidelines to learn about the contributing process and how to find suitable issues. If there are no unassigned 'help wanted' issues available, please wait until new ones are added.

We really appreciate your willingness to help. 😊

Are you preparing for Google Summer of Code? See our GSoC guidelines.