{"action":"created","issue":{"url":"https://api.github.com/repos/CuBoulder/express/issues/1084","repository_url":"https://api.github.com/repos/CuBoulder/express","labels_url":"https://api.github.com/repos/CuBoulder/express/issues/1084/labels{/name}","comments_url":"https://api.github.com/repos/CuBoulder/express/issues/1084/comments","events_url":"https://api.github.com/repos/CuBoulder/express/issues/1084/events","html_url":"https://github.com/CuBoulder/express/issues/1084","id":232326036,"number":1084,"title":"As A Site Owner, I Need To Grant Users Certain Permissions Without Adding Roles","user":{"login":"alexfinnarn","id":3640707,"avatar_url":"https://avatars3.githubusercontent.com/u/3640707?v=4","gravatar_id":"","url":"https://api.github.com/users/alexfinnarn","html_url":"https://github.com/alexfinnarn","followers_url":"https://api.github.com/users/alexfinnarn/followers","following_url":"https://api.github.com/users/alexfinnarn/following{/other_user}","gists_url":"https://api.github.com/users/alexfinnarn/gists{/gist_id}","starred_url":"https://api.github.com/users/alexfinnarn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alexfinnarn/subscriptions","organizations_url":"https://api.github.com/users/alexfinnarn/orgs","repos_url":"https://api.github.com/users/alexfinnarn/repos","events_url":"https://api.github.com/users/alexfinnarn/events{/privacy}","received_events_url":"https://api.github.com/users/alexfinnarn/received_events","type":"User","site_admin":false},"labels":[{"id":550960707,"url":"https://api.github.com/repos/CuBoulder/express/labels/Epic","name":"Epic","color":"3E4B9E","default":false},{"id":594120938,"url":"https://api.github.com/repos/CuBoulder/express/labels/evaluate-1:Director%20Approval","name":"evaluate-1:Director Approval","color":"b60205","default":false},{"id":550963320,"url":"https://api.github.com/repos/CuBoulder/express/labels/evaluate-1:More%20Information","name":"evaluate-1:More Information","color":"b60205","default":false},{"id":332637561,"url":"https://api.github.com/repos/CuBoulder/express/labels/improvement:UX","name":"improvement:UX","color":"1d76db","default":false}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-05-30T17:31:21Z","updated_at":"2018-02-01T00:36:17Z","closed_at":"2018-02-01T00:36:17Z","author_association":"MEMBER","body":"## Context\r\n\r\nWe are starting to see the need for permissions that don't fit into the roles we have defined in Express. We just added a Campaign Manager role that is only included in a custom add-on bundle. \r\n\r\nThe more roles we add like this, the more chance for side effects and extra debugging because of this potential difference between sites. \r\n\r\nYou could add canary users by this method as well. The beta bundles would only be seen by users we deem canaries.\r\n\r\n## Expected result\r\n\r\nWithin the configuration for the bundle, I can grant specific users any permissions needed for that bundle. \r\n\r\n## Current result\r\n\r\nNew user roles need to be created to grant specific permissions. \r\n\r\n## Possible Fix\r\n\r\nHack core. Yeah, let's do it! If you extend user_role_permissions() here https://api.drupal.org/api/drupal/modules%21user%21user.module/function/user_access/7.x, then you can do the same things that function does but add a check for individual permissions tied to an account. \r\n\r\nIn cu_user_role_permissions($account), you would call user_role_permissions() and then check an added db table that indexes uids to permission strings. \r\n\r\nThere are many modules that deal with node_access(). However, if you are working outside of nodes, granting permissions using those hooks wouldn't cover this use case. Adding the same check in hook_node_access() should take care of node access permissions.  \r\n\r\n## Process\r\n\r\n1. A SO would save the config form with a string of usernames that are granted a set of permissions. The set of permissions is defined in code so SO's don't have the option of choosing those permissions.  \r\n2. The username gets converted to uid and stored with one entry per permission. \r\n3. When user_access() is checked, the permissions for the uid are obtained from that db table and included in the access check. "},"comment":{"url":"https://api.github.com/repos/CuBoulder/express/issues/comments/362118884","html_url":"https://github.com/CuBoulder/express/issues/1084#issuecomment-362118884","issue_url":"https://api.github.com/repos/CuBoulder/express/issues/1084","id":362118884,"user":{"login":"kreynen","id":385234,"avatar_url":"https://avatars3.githubusercontent.com/u/385234?v=4","gravatar_id":"","url":"https://api.github.com/users/kreynen","html_url":"https://github.com/kreynen","followers_url":"https://api.github.com/users/kreynen/followers","following_url":"https://api.github.com/users/kreynen/following{/other_user}","gists_url":"https://api.github.com/users/kreynen/gists{/gist_id}","starred_url":"https://api.github.com/users/kreynen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kreynen/subscriptions","organizations_url":"https://api.github.com/users/kreynen/orgs","repos_url":"https://api.github.com/users/kreynen/repos","events_url":"https://api.github.com/users/kreynen/events{/privacy}","received_events_url":"https://api.github.com/users/kreynen/received_events","type":"User","site_admin":false},"created_at":"2018-02-01T00:36:17Z","updated_at":"2018-02-01T00:36:17Z","author_association":"OWNER","body":"We are adding some of this with Digital Campaign Managers and https://github.com/CuBoulder/express/issues/1869, but it still makes sense to keep the a set of core roles with common permission configurations.  Creating a role for the permission of every feature would just to too confusing for SO."}}
{"actor":{"display_login":"kreynen"}}