We currently only define Aegir Account Manager and Aegir Client roles. I think it would be helpful to add a couple more default roles, such as Aegir Platform Manager (e.g.: platform creation and mass migration perms) , and Aegir Administrator (e.g. all and only aegir perms).

Comments

j0nathan’s picture

j0nathan commented

We use a role named "aegir platform manager" which has those permissions:

hosting_clone module

  • create clone task

hosting_migrate module

  • create migrate task

hosting_platform module

  • create platform
  • delete platform
  • edit platform
  • view locked platforms
  • view platform

hosting_site module

  • create site
  • delete site
  • edit site
  • view site

hosting_task module

  • access task logs
  • create lock task
  • create unlock task

node module

  • view revisions

search module

  • search content
  • use advanced search
j0nathan’s picture

j0nathan commented

ergonlogic,
What would be the use case of giving "Aegir Administrator" but not full administration of the drupal frontend of the aegir ? Is there any real use case actually ?

ergonlogic’s picture

ergonlogic
he/him
Primary language English
Location Montréal, Québec 🇨🇦
commented

What would be the use case of giving "Aegir Administrator" but not full administration of the drupal frontend of the aegir ?

There are plenty of 'administer' permissions that aren't assigned to any roles at the moment. For example, enabling and disabling hosting features, configuring queues, and so forth. This is very different from enabling/disabling arbitrary modules, switching themes or deleting users.

j0nathan’s picture

j0nathan commented

All right, then so far we suggest 2 new roles:

  • aegir administrator
  • aegir platform manager
ergonlogic’s picture

ergonlogic
he/him
Primary language English
Location Montréal, Québec 🇨🇦
commented
Status: Active » Needs review

I've added these roles to the install profile in the dev-1403208-new_roles branch, along with and update hook in the hosting module.

I've also removed the 'access all views' permission from clients, as I believe this would potentially bypass the permissions in the views themselves.

ergonlogic’s picture

ergonlogic
he/him
Primary language English
Location Montréal, Québec 🇨🇦
commented
Status: Needs review » Fixed

Merged in fd5e16a3835002040663a

ergonlogic’s picture

ergonlogic
he/him
Primary language English
Location Montréal, Québec 🇨🇦
commented

Hmm... While I'd merged the hook_update in hosting, I failed to do the same for the Hostmaster profile.

Merged in 233e8abd2a1b6.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.