952488 - [admin] Add Locale Manager role and make permissions locale specific

Status: RESOLVED FIXED

(Webtools Graveyard :: Pontoon, defect, P1)

Description

[Jeff Beatty [:gueroJeff]]

Users should have varied levels of permissions with Pontoon to allow them to do more than submit translations as well as administrate tasks and roles within a project. These should also serve to provide security and protection to the assets of each project. See the link below to learn more.

Comment 1

[Matjaz Horvat [:mathjazz]]

Current permission system looks like this:

Once you log in with Persona, if we find your email to be member of the l10n group on Mozillians (https://mozillians.org/sl/search/?q=l10n), we grant you permission to localize. All projects and all locales. If your email is not to be found inside l10n or is not even registered on Mozillians, you can't do anything, but play with the test project.

I suggest we approach this bug in 3 steps:

Step 1.
Everybody who logs in should at least be able to submit suggestions (for all locales). Members of the l10n group on Mozillians need to be able to accept their suggestions as translations.

Step 2.
Members of the l10n group on Mozillians should be granted permission to submit translations, accept translations and commit to VCS only for a specific locale. We could use Mozillians for that (check if they are members of their locale's l10n group, e.g. l10n:de) or find another method.

Step 3.
We need to create a new level of users (locale module owners), that can also give other users permission to accept/localize/commit for a specific locale.

Comment 2

[Matjaz Horvat [:mathjazz]]

Step 1 implemented as part of the 2014-03-10 release:
https://github.com/mathjazz/pontoon/releases/tag/2014-03-10

Comment 3

[Matjaz Horvat [:mathjazz]]

Once steps 2 and 3 are implemented, we might consider exporting user permissions from Verbatim as a starting point.

Comment 4

[Matjaz Horvat [:mathjazz]]

And/Or, authenticating users against LDAP while logging in with Persona, as airmozilla does.

Comment 5

[Osmose [:osmose, :mkelly]]

After discussing this at Whistler, we decided to not bother with automagically pulling permissions from some other service and just going with locale module owners. To be more specific, the work that's left is:

- Convert the can_translate permission to be specific to a single locale. Existing users with the permission may either be given the permission for every locale, or maybe we just go through some sort've migration process and pull the perms from somewhere.
- Add a new permission for granting the can_translate permission that is specific to a single locale. This is the "locale module owner" permission.

mathjazz: What do you think we should do about converting the existing can_translate permissions?

Comment 6

[Matjaz Horvat [:mathjazz]]

For existing users, we have to figure out what locales they are contributing to and give them rights for these locales. Should be just one locale for most of them. We should ignore locales they contributed to just to test Pontoon or by mistake.

On top of that, we could also export locale owners from verbatim and pootle, store them and give them rights automatically.

Comment 7

[Matjaz Horvat [:mathjazz]]

Straight from my inbox:
Mozillians APIv1 will be phasing out in 6 months (10th of February 2015 [2016 I guess?]). You will need to migrate your current functionality over to the new API by then. We should have this bug resolved earlier, but it's still valuable to have this date documented somewhere.

Comment 8

[Jarek Śmiejczak [:jotes]]

:Osmose :mathjazz I want to use https://pypi.python.org/pypi/django-permission for row level permissions. Is this acceptable or do you wish to use something different?

Comment 9

[Osmose [:osmose, :mkelly]]

(In reply to Jarek Śmiejczak from comment #8)
> :Osmose :mathjazz I want to use
> https://pypi.python.org/pypi/django-permission for row level permissions. Is
> this acceptable or do you wish to use something different?

The library itself looks fine, but reading the docs I find it a bit confusing. It seems like it operates by granting users _all_ permissions based on the logic class chosen? Based on the docs, I can't figure out how we 1) will limit our custom `can_translate` permission to be per-locale, and 2) will limit who can edit that first permission per-locale. Maybe I'm missing something?

Comment 10

[Jarek Śmiejczak [:jotes]]

:Osmose As we discussed on irc i've researched django-guardian. Looks like it's a lot simpler to use, so i'll try to use it to fix this issue.

Comment 11

[[github robot]]

Commits pushed to master at https://github.com/mozilla/pontoon

https://github.com/mozilla/pontoon/commit/70f62403b08e3e56cb99d1f836feaef43d7b7c52
Fix bug 952488 - Added locale managers

https://github.com/mozilla/pontoon/commit/e232d61e4793d35995c9a13e98619de8a34ecc9e
Merge pull request #219 from jotes/locale_managers

Fix bug 952488 - Added locale managers

Comment 12

[[github robot]]

Commits pushed to master at https://github.com/mozilla/pontoon

https://github.com/mozilla/pontoon/commit/fc61b6999d94be67cb3dd481d055b14493e436b5
Bug 952488 - Add locale managers UI

https://github.com/mozilla/pontoon/commit/62422e20fbce7d024370af45f4405e30c09ab83a
Merge pull request #247 from mathjazz/locale-owners-ui

Bug 952488 - Add locale managers UI

Comment 13

[[github robot]]

Commit pushed to master at https://github.com/mozilla/pontoon

https://github.com/mozilla/pontoon/commit/6038e6c9304ca963168c1cc64f16bdb15283ea53
Bug 952488: Properly grant permission

Only grant new permissions to users with old can_localize permission

Comment 14

[[github robot]]

Commit pushed to master at https://github.com/mozilla/pontoon

https://github.com/mozilla/pontoon/commit/5b87cdcadf7fa052968fdb1fb9bac0b14a2aad81
Bug 952488: Allow Managers to manage other Managers of their Team

Also: Rename Team Admin(s) to Team Manager(s) to distinguish against
(Pontoon) Admins. Will be useful when we add Project Managers.