Permissions Migrations

[ErisDS]

At present, we have no system by which permissions can be added to the permissions.json file and safely migrated.

We need to design a system which allows permissions to be added, so that we can add new permissions for the configuration API, apps API, and any other endpoints which we need to create.

It is expected that if we create a situation where a permission needs to be changed or removed, that the migration system would have to be updated to manage those cases.

At present, permissions migrations are triggered as a part of the migration system, which requires that the database version be bumped. Whether or not this should be required in future is up for discussion.

If we continue to use the version bumping to trigger a migration, then we need to protect the schema.js, fixtures.json and permissions.json files from being updated without a version bump in some way - possibly via a simple test which checks the content.

[ErisDS]

Does anyone have any good ideas about how to go about this?

My major concern is that we expect apps to modify permissions - so how do we manage not overwriting app changes? Or should we just not care for now and assume permissions should be exactly as we set them, and that anyone changing them has to re-change them after a migration?

[letsjustfixit]

Any news on this?

[ErisDS]

Labelling all the open permissions related issues (there are several) with both permissions and later as I'm working on a spec to solve the immediate issues as well as a long term plan, which will replace all of these issues.

[ErisDS]

Removed the "later" and "fix wanted" labels from this now. We no longer need to reopen this later as the refactoring work done in #6572 has made it possible to do permission migrations the same as any other fixture.