867958 - implement the ability to add/remove group membership

Status: RESOLVED FIXED

(Marketplace Graveyard :: Admin Tools, enhancement, P5)

Description

[Andrew Williamson [:eviljeff]]

The user lookup result page shows which groups a user a member of (e.g. App Reviewers; Senior Theme Reviewer; etc).  What is missing is a way of editing these groups once bug 844415 takes away the /admin/ tool [3] that we currently use.  

So I propose we either add the functionality to add and remove groups directly to the user lookup result page[1], or to the edit user account page [2]

[1] https://marketplace.firefox.com/lookup/user/631/summary
[2] https://marketplace.firefox.com/users/631/edit
[3] https://marketplace.firefox.com/admin/models/access/group/

To limit exploits this tool wouldn't let include the Admins group be added or removed.

Comment 1

[Wil Clouser [:clouserw]]

We should identify a subset of groups which can be adjusted via the web.  I assume you're interested in the reviewer groups?

Comment 2

[Andrew Williamson [:eviljeff]]

(In reply to Wil Clouser [:clouserw] from comment #1)
> We should identify a subset of groups which can be adjusted via the web.  I
> assume you're interested in the reviewer groups?

Yeah, the reviewer groups are the common use case for us.  But it might as well work for all the groups if there isn't a significant risk attached to them.

I think we only need to exclude 'Admins'.

Comment 3

[Wil Clouser [:clouserw]]

How often are you changing groups?  Is filing bugs for ops to run the commands a significant hardship?

Comment 4

[Andrew Williamson [:eviljeff]]

(In reply to Wil Clouser [:clouserw] from comment #3)
> How often are you changing groups?  Is filing bugs for ops to run the
> commands a significant hardship?

If our onboaring goes as planned we could be adding 50+ reviewers over the next 6 months, and we will be adding them one at a time on prod once they've proven themselves on dev first.  When they have met the standard we'll want them live straight away (before their motivation drops off).   

Pushing this kind of admin task onto ops isn't desirable for us (or them I would have thought) and just adds extra work.

Comment 5

[Andy McKay]

Altering all groups doesn't great. It sound like we need to limit what this API can do. Presumably there's some basic tasks "add user X to reviewer group" or "remove user Y from reviewer group". Anything more fine grained should go through an admin I presume.

Comment 6

[Andrew Williamson [:eviljeff]]

I would expect access to be limited to admins.  But the groups can be all groups except Admins.

Comment 7

[Andrew Williamson [:eviljeff]]

I'm writing an API to add a subset of groups and some UI to the lookup tool.

Comment 8

[Andrew Williamson [:eviljeff]]

https://github.com/mozilla/zamboni/pull/3209

Comment 9

[Andrew Williamson [:eviljeff]]

https://github.com/mozilla/zamboni/commit/9db3a6c86d8a99e888dfd4596b5185edf5acb975