Access control for different applications

[arjunk]

Context

In an earlier epic, we had implemented access control for sync. The purpose of this was to streamline the kind of actions that users can perform on the mobile app. The permissions were left open because of some side effects that implementations can do. The motivation behind this is documented here

The initial motivation behind this epic is scale. In order to scale the Rejuvenating Water Bodies project, we need the ability to have multiple people uploading csv files for a new workorder. This includes farmer details and workorder details. However, for users to be able to do this, they need to be an organisation admin, which provides them access to edit programs etc, which is undesirable.

We have always been wanting to have fine grained controls on the web application, and corresponding checks on the server. We will implement these controls with this epic.

Implementation details?

New privileges will be implemented as mentioned in this spreadsheet. It also contains some common questions about the implementation.

Tasks

Beta Give feedback

1. Visibility of features on avni-webapp (Admin) avni-webapp#879
   +0
   
2. Visibility of features on avni-webapp (base screen) avni-webapp#887
   +0
   
3. Visibility of features on avni-webapp (App Designer) avni-webapp#984
   +0
   
4. Show new privileges on the Permissions screen avni-webapp#985
   +0
   
5. Implement privileges in server avni-server#500
   +0
   
6. Limit privileges of all current groups with "All Privileges" turned on (Migration) avni-server#588
   +0
   
7. Backwards compatibility check for avni-client avni-client#1060
   +0
   
8. [Spike] - Identify the right way to implement privileges #1294
   +0
   
9. Create new privileges [Base story] avni-server#499
   +0
   
10. Show Upload data option for non-organisation admins avni-webapp#901
    +0
    
11. Disable has_all_privileges in groups screen for Admin group avni-webapp#995
    +0
    
12. Remove org admin switch when creating user avni-webapp#996
    +0
    
13. Assign groups when creating user on the Admin screen avni-webapp#997
    +0
    
14. Add group membership when creating users using csv import avni-server#573
    +0
    
15. Create Admin group when creating an organisation avni-server#579
    +0
    

[petmongrels]

Access to the application is essentially access to the underlying data, so what is the benefit or facility one gets by providing app-level access?