feat: better group perms mgmt

[wesleyboar]

Overview

Allow developers to offer Groups with overlapping permissions but less redundant code.

Related

• CMD-189
• includes:
  • refactor: simpler syntax for group perms #894
  • feat: grid editor group and permissions #896
  • refactor: less calls to add_perm #899

Changes

• added a util.py
• added a function add_perm
• changed group permissions to use new utility function
• added "Grid Editor (Basic)" and "Grid Editor (Advanced)"
• added permission Can change static placeholder¹

Testing

via Custom Migration

1. Create/Open a Core-CMS instance.
2. In the CMS container², add groups implicitly via migration:
   python manage.py migrate taccsite_cms
3. Verify Groups in admin UI, and their permissions, are present.
4. Reverse that migration:
   python manage.py migrate taccsite_cms zero
5. Verify Groups in admin, and their permissions, are absent.
6. Add groups explicitely via migration:
   python manage.py migrate taccsite_cms 0001_add_groups
7. Verify Groups in admin, and their permissions, are present.
8. Reverse that migration:
   python manage.py migrate taccsite_cms zero
9. Verify Groups in admin, and their permissions, are absent.

via Mgmt. Command

1. Create/Open a Core-CMS instance.
2. In the CMS container², run:
   • python manage.py set_group_perms grid_editor_basic grid_editor_advanced text_editor_basic text_editor_advanced media_editor_basic media_editor_advanced news_writer_basic news_writer_advanced
3. In CMS admin UI, verify those 8 groups are created.
4. Verify the groups each have relevant permissions.
   ^{I merely skimmed the results.}

UI

via Custom Migration

implicit.migrate.then.revert.mov

explicit.migrate.then.revert.mov

Note

The SearchAppHook error is unrelated. I have a local page expecting code from another branch.

via Mgmt. Command

before	after

grid	media	news	text

Footnotes

1. Let's editor see "Edit" and "View published" button. WTCS users could not. One avid TACC editor sometimes can not. ↩

2. Run docker exec -it core_cms /bin/bash to enter CMS container. ↩ ↩²

[wesleyboar]

Tasks
From joint peer code review on Zoom:

• Document what each of these groups provide for the user (one sentence) i.e. why you would give someone this group.
• Add a custom migration for these. (New migration might remove/change permissions.)
  • The migration could empty the existing permission form existing groups, then run the scripts.
  • A good primer on migration.

[wesleyboar]

@taoteg, please review updated documentation.

[wesleyboar]

@jarosenb & @rstijerina, please review new taccsite_cms/migrations/ and (optionally) example migrations for future devs.