[Permissions] User Roles

[ridz1208]

Based on the feedback from the focus group LORIS meeting.

This feature allows managers/coordinators to assign permissions to users based on their roles in the study. Roles are a pre-configured set of permissions automatically assigned when the user is given a new role.

What needs to be done?

1. Create a roles configuration module. This module allows a front end user to create, modify or delete roles and alter role-permission associations from a centralized place.
   • This module needs to be intelligent enough to know how to update the existing data when roles are altered. For example, if existing users in the database are given a certain role and a new permission is later added to that role, it is this module's responsibility to handle the update of the user's permissions who currently have that role. this process should be explicit (The user making the changes in the module should be offered a popup to display which users need to be updated to get the new permission and alternatively which should instead see their role revoked)
   • This module should be intelligent enough to evaluate the state of the database and automatically offer to fix discrepancies. For example, If a permission get added to a role directly in SQL (bypassing the module's "ad permission" functionality), the module should offer an analyzer to evaluate which user's roles no longer match their permissions and offer solutions to fix these issues
2. Implement the UI in the user_accounts module. The scope of the module above is limited to roles, role-permission associations and database integrity; a user interface to allow managers to assign roles to user should be implemented and added to the user_accounts module.
   • N.B. This feature has been attempted before and making this interface intuitive was a considerable challenge. For this reason we suggest the following behaviour. Role assignment for users should be done using an "Add Role" button which displays the roles available and a submit button should be clicked after having selected a role. Any auto-submission without an explicit button click runs the risk of users accidentally assigning the wrong roles and undoing that by revoking the role which in turn alters the edited user's permissions and risking them losing permissions they already had without the role.

This feature mostly involves front-end work and presents some logical challenges, proper design before implementation will be necessary.

Parent task: #7346

Old deprecated implementation:

• Part 1: [Role/Permission] Adding SQL schema and DAOs (1 of 4) #3537
• Part 2: [Role/Permission] Configuration tool (2 of 4) #3538
• Part 3: [Role/Permission] User accounts changes (3 of 4) #3539
• Part 4: [Role/Permission] clean-up (4 of 4) #3540