Question: Collaboration invites with User permissions

[tiblu]

Please Indicate One:

• Editorial
• Question
• Feedback
• Blocking Issue
• Non-Blocking Issue

Please Describe the Issue:

We need to describe such activity - Sally invited John as editor and Lisa as administrator to collaborate on a document

I think the right event would be "Invite" (https://www.w3.org/TR/activitystreams-vocabulary/#dfn-invite) as all the invited (John, Lisa) need to accept the invite, in order to collaborate on the document and see it in their personal document list.

• Sally is the "actor"
• John and Lisa would be the "target"
• Document would be the "object"

Questions:

• Is the "Invite" (https://www.w3.org/TR/activitystreams-vocabulary/#dfn-invite) the correct event to use?
• IF it is, where would I put the invited permissions in the activity? Each invited person has their own permission (administrator, editor)?
• Each invite has their id by which User can open the invitation up. Where would that fit best?

Related to:

• New Crowdin updates citizenos/citizenos-fe#112

[sebilasse]

Yes, it is missing in the specs.
Instead of ACL permissions, various people go for capabilities and there is no concensus yet.
Some use an own Assign action and some use Invite …
Basically I would say you can define your permission as a Relationship but the question would rather be who supports what.
But the current meetings were there to find concencus. Next meeting https://socialhub.activitypub.rocks/t/developers-meeting-7-a-standard-way-to-query-in-activitypub/2488

[evanp]

There isn't a way to represent this kind of access control in AS2.

One way to do it is to have the object of the Invite activity be an Activity. So, for John, the invitation might be:

{
   "@context": "https://www.w3.org/ns/activitystreams",
   "actor": {
      "id": "https://example.com/actor/sally",
   }
   "type": "Invite",
   "object": {
      "type": "Edit",
      "object": {
          "type": "Document",
          "id": "https://example.com/doc/1"
      }
   },
   "target": "https://example.com/actor/john"
}

It's also possible to use multiple target values and multiple object values. However, it's not possible to say which object is for which target, without using separate Invite activities.

This is roughly what the abstract model would be; however AFAIK this isn't widely used, and probably is open to interpretation by different implementers. The best next step would be to write up a FEP for the schema and collect feedback from other implementers.

[github-actions]

This issue has been labelled as potentially needing a FEP, and contributors are welcome to submit a FEP on the topic.
Note that issues may be closed without the FEP being created; that does not mean that the FEP is no longer needed.

[evanp]

Based on the feedback here, this probably requires a FEP or other extension document. I'm going to close it.