1281938 - Searching for triage owners who are not members of a group

Status: NEW

(bugzilla.mozilla.org :: General, defect, P3)

Description

[Benjamin Smedberg]

In general, triage leads for each component are responsible for making decisions and keeping correct progress on the bugs in their component(s). In some cases, triage leads may not have access to every bug in their component, because of security groups.

This is a request for a report/alerting system so that the Bugmaster and her delegate(s) can query a list of bugs which are not accessible to the triage leads of those components. Then the bugmaster can manually add them to the cc list if appropriate, or take other steps to resolve the mismatch.

This presumbaly depends on having the triage leads in bugzilla from bug 1280491.

Comment 1

[Emma Humphries ☕️🎸🧞‍♀️✨ (she/they) [:emceeaich] (Pacific Time) use needinfo]

There's a field called "reporter accessible" which I'm guessing indicates if the bug can be viewed by the user who filed it. If there was a similar "triager accessible" field, then I could make a regular nagging report of all the bugs that can't be seen by the people who need to triage them.

Would that be an efficient solution to this, or is there another way to go about. I'm leery of creating new, computed fields on bugs.

Comment 2

[David Lawrence [:dkl]]

(In reply to Emma Humphries ☕️ [:emceeaich] (UTC-8) +needinfo me from comment #1)
> There's a field called "reporter accessible" which I'm guessing indicates if
> the bug can be viewed by the user who filed it. If there was a similar
> "triager accessible" field, then I could make a regular nagging report of
> all the bugs that can't be seen by the people who need to triage them.
> 
> Would that be an efficient solution to this, or is there another way to go
> about. I'm leery of creating new, computed fields on bugs.

The reporter accessible and cc accessible checkboxes are to remove visibility to users who would normally be able to see a bug automatically due to being the reporter or on the cc list. We do not automatically grant triage component owners access to a private bug just because they are a component owner. So I dont think having a triager accessible checkbox would be useful in this case. 

I would just do a form that shows a list of bug ids broken down by component that the current user cannot see but yet they are the triage owner for the component. If the current logged in user does not own any components they would not be able to access the report or it would just be empty. Either one is fine.

dkl

Comment 3

[Emma Humphries ☕️🎸🧞‍♀️✨ (she/they) [:emceeaich] (Pacific Time) use needinfo]

(In reply to David Lawrence [:dkl] from comment #2)
> I would just do a form that shows a list of bug ids broken down by component
> that the current user cannot see but yet they are the triage owner for the
> component. If the current logged in user does not own any components they
> would not be able to access the report or it would just be empty. Either one
> is fine.

To clarify, the person who'd be using this would be someone with permissions to see the bugs, not the triage owner. 

If you go into the report, the options would be:

1) show me all bugs for which the triage owner does not have access
2) show me all bugs in these components for which the triage owner does not have access

I am not sure about this case:

3) show me all the bugs for which I'm responsible for as triage owner, but can't see?

As far as I can tell, we don't show bug numbers or any meta data on security bugs in buglists if the user can't see them.

Comment 4

[David Lawrence [:dkl]]

(In reply to Emma Humphries ☕️ [:emceeaich] (UTC-8) +needinfo me from comment #3)
> To clarify, the person who'd be using this would be someone with permissions
> to see the bugs, not the triage owner. 
> 
> If you go into the report, the options would be:
> 
> 1) show me all bugs for which the triage owner does not have access
> 2) show me all bugs in these components for which the triage owner does not
> have access
> 
> I am not sure about this case:
> 
> 3) show me all the bugs for which I'm responsible for as triage owner, but
> can't see?
> 
> As far as I can tell, we don't show bug numbers or any meta data on security
> bugs in buglists if the user can't see them.

Ok so we can do it similar to how we do the user activity report where you can enter a users email account and list bugs they cannot see that they are triage owner before. We can could even provide a product and component drop down to narrow down the results. We can use the 'editcomponents' group to decide if to display the user email field or not. If the current user is not in 'editcomponents' then they can only see their bugs. 

Sound good?

dkl

Comment 5

[Emma Humphries ☕️🎸🧞‍♀️✨ (she/they) [:emceeaich] (Pacific Time) use needinfo]

(In reply to David Lawrence [:dkl] from comment #4)
> Ok so we can do it similar to how we do the user activity report where you
> can enter a users email account and list bugs they cannot see that they are
> triage owner before. We can could even provide a product and component drop
> down to narrow down the results. We can use the 'editcomponents' group to
> decide if to display the user email field or not. If the current user is not
> in 'editcomponents' then they can only see their bugs. 

Okay, if I go to the report, as someone in edit components, would I see all bugs for all the triage owners, or would I have to enter a bug mail?

I'd like to just have one report that I could click and get back as a bug list so that I could go through each one and CC the triage lead on.

Comment 6

[Emma Humphries ☕️🎸🧞‍♀️✨ (she/they) [:emceeaich] (Pacific Time) use needinfo]

I can solve this bug if I have a way to search for triage_owner NOT in(%group.name%)

Comment 7

[Dylan Hardison [:dylan] (he/him)]

If this bug was just s/Report/API/, I suspect it would be not more than 7 lines of code.

How about that?

Comment 8

[Emma Humphries ☕️🎸🧞‍♀️✨ (she/they) [:emceeaich] (Pacific Time) use needinfo]

That would be awesome!