November 17, 2021

Time/Place

This meeting is held virtually via Zoom, with an open channel for chatter on Slack. Anyone is welcome to join. Here is the info:

• Time: 1:00pm Eastern Time US (UTC-5)
• Zoom link: https://zoom.us/j/97345581392
• Join us on the Slack Islandora 8 Channel https://islandora.slack.com/archives/CM5PPAV28
• Chair rota
  • Mark
  • Melissa
  • Danny
  • Rosie 🪑
  • Seth
  • Eli

Attendees

• Kirsta Staplefeldt
• Sarah Goldstein
• Don Richards
• Rosie Lefaive
• Alexander O'Neill
• Seth Shaw
• Eli Zoller
• Natkeeran Kanthan
• Melissa Anez
• Annie Oelschlager
• Adam Vessey
• Kristina Spurgin
• Kyle Huynh
• Jordan Dukart
• Bethany Seeger
• Mark Jordan
• Jared Whiklo ⭐ 📝

Agenda

1. Special Sprint Topic: Access Control! (Danny talking about Groups)
2. Please register for an invitation to the first sprint meeting on November 29th, where we will be building the backlog for the sprint. Also, please sign up for the sprint and indicate your area of interest if you have not done so
3. Islandora dependencies on UI based things: https://github.com/Islandora/islandora/blob/2.x/islandora.info.yml#L22-L26. (@jordandukart)

Minutes

1. Danny was not in attendance but had something to announce. Seemed to be around the use of Group, Seth understands it was using a sub-module called Group Media.

   • Jordan says that DGI has evaluated Group and they believe it is set up more to support what was considered a multi-site in Islandora Legacy. So you have faculty that become parts of different groups, it creates sub-sets of permissions for its groups. So you get a set of permissions for each group you create.
   • Seth's understanding from talking to Noah is he would create a "group" for special collections staff so they could see things that are not currently accessible to the public and then they could be moved to a "public" group.
   • Bethany spent a lot of time looking at groups/access control. This video had some good information about how Group works in the background. Group creates a new node to store the permissions separate from the actual node which can make bulk ingest require extra work. She is now using workbench
   • Eli is using the Group module and are creating a new group for each collection and when an item is added to the collection it is added to that group. Doesn't cover all the desired access points, so he has a node_access hook and did some additional Solr work.
   • With a large number of groups you get a UI issue when trying to view the permissions page. There is also some UI issues in keeping clear the difference between editing the "thing" and editing the permissions on the "thing".
   • There are some serious concerns with Group but will have to wait to hear from Danny.
   • How generalizable any code anyone has written to work with Group? Eli thinks their collection based structure might not be common. But it sounds like it might be pretty common 😉
   • What are the common expectations for access control across Islandora institutions?
     • Admin user, manager user, and general user.
     • Collection based permissions.
     • Media level permissions (ie. some media are publically accessible and some are private).
     • IR self-submission where an item (or multiple items) would be a single "group".
   • Group does not currently allow for a neutral response from an access "checker" so things must evalute as "yes you can access" or "no you can't". This makes it hard to have multiple access control tools working on a single object (ie. actual edit/view permissions with Group and an Embargo module controlling view access)
   • Has anyone looked at a proxy type module to control access. (ie. https://www.drupal.org/project/private_files_download_permission) This only works for files currently, so we would have to write the node part. In Seth's opinion this would be more work than worth it is easier to add file permissions.
   • Some of the current Drupal access control make assumptions that are not the same as how Islandora has setup its data. (ie. we use media entities, others just add a file in a field). So any out of the box solution might require some work to make it fit Islandora objects.

2. Sprint is coming up Nov 29th with a mid-day meeting (11am ET).

   Meeting message will be sent to those that submitted their email.

   What do people prefer for registering for Zoom sessions? There should be a way to allow people to self-register for ongoing meeting notifications.

   Topics will be Access Control, Default Islandora Experience and ISLE issues.

   Meet on the first day and agree on how often to meet and then break into sub-groups and those groups can decide on what their plan of action.

3. DGI wants to start locking some things down on their production hosting site and wanted to know if Views UI and Context UI are really required as hard dependencies. Could these be removed as dependencies to avoid people breaking their hosted site by accident?

   These were setup a long time ago and probably added to avoid installation issues. This was also before the islandora_defaults was split out from core.

   Expect a PR from someone at DGI in the future related to this.