Service Accounts for API consumation (32h)

[RolandStuder]

Problem

Currently API tokens can only be received by people with their respective permissions, see https://github.com/hitobito/hitobito/blob/master/doc/development/05_rest_api.md

So to give to access to an application independent of a person is currently not possible.

Solution

Creation of service accounts with optionally configurable permissions.

Acceptance Criteria

• For every layer you can create/delete impersonal API Tokens

• A token can be described by a name and a description

• A token is attached to a certain layer, its rights are derived from said layer

• API Token can only be created by people with :layer_and_below_full and :layer_full permissions

• per Token I can configure whether a specific API token can

  • read People on Layer
  • read People on Layer and Below
  • read Groups (API to be extended)
  • read Events (API to come)

Open Questions

• Should private Attributes (like insurance on groups, and private details on people) be included?
• Where in the UI should this be placed? Belongs to settings, but if a person has access to all layers, it also should have access to all API tokens, so this gets messy. On the info Tab is not really nice, adding a new tab, will pollute the already very filled space.

[nchiapol]

We (Cevi) would wellcome such Service Accounts as well.

[amaierhofer]

• service_tokens(layer_id: int, name:string, description:text, people:boolean, groups:boolean, events:boolean) + crud (8h)
• Integrate with devise authentication (8h)
• Integrate with abilities / user_context (16h)

[diegosteiner]

This is an important feature for us at PBS. We've put some thoughts into this as well and imagined something like this:

@adriananderegg , @michaelschaer : please confirm

[RolandStuder]

@diegosteiner Thx for the Mockups!

You put an edit Icon behind every permission, is there some reasoning for that? I assume we would edit these permissiosn all on an edit screen. Or not?

[diegosteiner]

You put an edit Icon behind every permission, is there some reasoning for that? I assume we would edit these permissiosn all on an edit screen. Or not?

No particular reason. To edit all permissions on the edit screen is fine of course.