Groups

[balloob]

For permissions, we need to add groups to the user system. The idea is that permission policies will be attached to groups instead of users. That way it's easy to have a group of "Visitors" or "Kids" with reduced access to rooms and devices.

I would want to keep the "is_owner" flag on the user and that only one owner can exist. For permissions, an owner is treated like a "Super Admin" and will always have access to everything, regardless of the group and it's policy the owner belongs to.

A basic implementation of groups as I just described is available here: home-assistant/core#16935 . It introduces two groups "System" and "Family". Users in the system group will be protected from changes. Examples will be Hass.io, Google Assistant etc. The Family group is the group with the normal users (name can be changed).

[awarecan]

One user can only belongs one group is not intuitive. I will suggest the underlying implement should support multiple groups per user. For the first phase, we can limit it to one in the UI.

It is complex but doable if we have user:group and group:policy both support m:n mapping, therefore we should have some sort smash process to compute the effective permissions for each user, cache and serialization as well.

[cgarwood]

Agreed, we should definitely allow users to be in multiple groups

[balloob]

Please include some use cases for multiple groups. "Not intuitive" and "definitely allow" are not enough 😉

[pvizeli]

We create a group per room, and put user in the group they need access selected room.

[helto4real]

My 2 cents
Use Case:

• group for rooms as suggested second that
• group for specific device types as cameras for example
• group see history of cartain devices like trackers

[balloob]

Okay, I like Pascal's use cases.

[balloob]

Updated PR to support multiple groups