Add roles and permissions schema

[vahid-sohrabloo]

I think we need role for user and access to action (like create channel) based on role.

[sampaiodiego]

Yeah we need this.

This will define some implementations of #168 and #206

[vahid-sohrabloo]

No milestone?

[engelgabriel]

@rwakida can you help with that?

[rwakida]

@engelgabriel sure! @Sing-Li used restivus which in turn depends on alanning:meteor-roles. Is meteor-roles a good package to use? Do we have any documentation on what roles/permissions we'll need?

[Sing-Li]

@rwakida - no documentation that i know of, but if you get it started with a PR or two, I'm sure all the stake-holders will chime in, or make mods to ensure everything works.

The only role that core currently uses, I think, is: [admin]

The extended roles used by REST APIs (that should only be created by an external, non-main-repo tool) are: [testagent, adminautomation]

Some other extended roles that will likely be required in the future: [configurator, provisioningagent]

The extended roles that you mentioned in another thread #455 may be: [botdelegate]

Permissions:

A starter set may be ['post-message', 'edit-message' , 'delete-message', 'create-public-room', 'create-private-room', 'read-all-messages']

Complete permissions set probably takes some thought/design, since the 'expressive-ness' of later 'policies' implementation will critically depend on them.

JMHO

[rwakida]

Thanks @Sing-Li !

[lostwings211]

Hi Sing-Li,

I am very new to Meteor and Rocket.Chat, right now I am in the middle of a task to auto-provision Channel via REST bulk/createRoom API, however I am getting a "You do not have permission to do this." REST response.

Looks to me this would be role/permission related, so would you kindly let me know

1. how to assign the [testagent, adminautomation] roles to a given user?
2. which data store does that role/user association info gets persist to?

[Sing-Li]

@lostwings211 Thanks for the questions. You will have to do this manually at this time. We will have some provisioning and management tools to get this done a little later - once the roles and permission system is in place. The package that we used is the well-known alanning:roles, the association is persisted into the user collection. If you need more details, please join the demo chat on the rocket.chat home page. Our team hangs out there most of the time. I'll be more than glad to help.

[marceloschmidt]

@rwakida I'm interested in advancing into roles. Have you done anything on that topic? If so, may I continue your work? Thanks!

[rwakida]

@marceloschmidt I'm almost done testing. I'll create a pull request within the next 24 hours...or at least push my branch if I feel it's not ready. Thanks.

[marceloschmidt]

Thank you!

[rwakida]

Hi @marceloschmidt . I created a pull request #818. Thanks!