3scale/issues-test — Issue #339: admin role  management broken (viadeo/pingar)
Author: HakubJozak
Created: 2012-02-13 17:42:11+00:00
State: open

Restore the ADMIN Role management system on enterprise installations. This has been
broken badly. Both Viadeo and Pingar want this in order to create different roles for their
admins. The specification is:

- Each of the TABS on the management dashboard (dashboard, accounts, stats,...)
has a control point on it. If the user has a role which allows them to SEE and ACCESS
the tab then
- the tab is listed in the menu
- the items under the tab can be accessed.
If the user does not have the permission then then tab does not appear and is not
accessible.
- Under "Groups": https://enterprise-admin.3scale.net/cms/groups it possible to add a
second type of group (in addition to PARTNER) which is called ADMINISTRATOR
and when creating this type of group, the tick boxes which can be activated ARE
the list of tabs above [dashboard, accounts, ...)
- Under https://enterprise-admin.3scale.net/admin/account/users, admins can select
if a user (of the admin account) is an ADMIN or a MEMBER. If admin, all permissions
are assumed. IF Member, a list of the GROUPS available hould appear and
it should be possible to tick which groups the MEMBER belongs to. [NB: this view
exists but it is showing the WRONG groups - it is showing partner groups right now
- this is a bug]
- Another (current) BUG is that https://enterprise-admin.3scale.net/cms/groups when
editing a partner group, the list of ADMIN control points is being shown.
- Last item is to check the interface throughout and try to avoid having links between
sections if and when the user does not have permission for the section being linked
to.

Tasks
- add back admin group type
- members cannot access admin/account/users
- users list do not show the groups?
- members can access legal_terms under cms, i.e area not protected
- members can change portal content. i.e area not protected
- hide sdk access since it makes no sense to non-skype
- user group edition is broken
- "site" menu item shows for users not having portal permissions
- make sure only members of provider can have groups
- remove groups when a user stops being member
- user can make itself admin
- test the whole authorization, at least the most important parts
- review all rules and email them to @dev-list
- contributor role must be deleted or hide
- finish stashed bcms permissions tests for provider_any
- finance tab and subsections have access control
- api & plans section access control
- rake + cap task seed groups and so on
- settings section access control
- check that logo administration is not broken with new changes
- account section access control
- stats section access control
- data export access control
- add comment about duplicated whens in features/support/paths.rb
- fix broken tests
- seed clean.3scale.net after

https://www.pivotaltracker.com/story/show/13686747