600442 - Teach us about add-on author roles

Status: RESOLVED FIXED

(addons.mozilla.org Graveyard :: Developer Pages, defect, P1)

Description

[Jeff Balogh (:jbalogh)]

Here are the roles zamboni ported from remora:

AUTHOR_CHOICES = {
    AUTHOR_ROLE_NONE: 'None',
    AUTHOR_ROLE_VIEWER: 'Viewer',
    AUTHOR_ROLE_DEV: 'Developer',
    AUTHOR_ROLE_OWNER: 'Owner',
    AUTHOR_ROLE_ADMIN: 'Admin',
    AUTHOR_ROLE_ADMINOWNER: 'Admin & Owner',
}

What are the rules for the roles?  What does each give you access to?  Or if it's easier, what pages are excluded for each role?  If you're lower down on this list, do you have all the powers of the roles above you (so Viewer is a subset of Developer)? Do we need all these roles?  What's the difference between admin, owner, and adminowner?

Comment 1

[Jeff Balogh (:jbalogh)]

Looks like we can drop some roles already:

mysql> select role, count(*) as c from addons_users group by role;
+------+-------+
| role | c     |
+------+-------+
|    1 |    99 | 
|    4 |   491 | 
|    5 | 20030 | 
+------+-------+
3 rows in set (0.87 sec)

# Add-on author roles.
AUTHOR_ROLE_NONE = 0
AUTHOR_ROLE_VIEWER = 1
AUTHOR_ROLE_DEV = 4
AUTHOR_ROLE_OWNER = 5
AUTHOR_ROLE_ADMIN = 6
AUTHOR_ROLE_ADMINOWNER = 7

Comment 2

[Justin Scott [:fligtar]]

These roles are used for permissions in the dev tools, but not all are in the db. The permissions method in remora would take the db role and user's site-wide permissions into account and return one of these roles.

* None is when the user has no access to an add-on.
* Viewer can view all of the dev tools for an add-on but can't make any changes.
* Dev can make all changes except modifying authors and deleting the add-on.
* Owner can make all changes.
* Admin can make all changes plus admin-only settings like trusted, guid change, add-on type change.
* Admin owner is when the user owns an add-on and is an admin. I think this was only used when checking if the user could make the add-on's stats public or not. I'm fine with removing that role now and letting admins change that if needed.

I recommend looking at how remora handles these roles across the site to make sure they match.