Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Clarify device group read-only permission #772

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Clarify device group read-only permission #772

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 17 additions & 16 deletions source/user-guide/account-management/team-based-access.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,15 +77,15 @@ The member then has a combined list of scopes:

* From read-only-users:

* ci:read
* source:read
* devices:read
* targets:read
* containers:read
* ``ci:read``
* ``source:read``
* ``devices:read``
* ``targets:read``
* ``containers:read``

* From read-write-ci

* ci:read-update
* ``ci:read-update``

The user now has read **and** write (update) access to the CI,
while retaining the read-only scopes for the other resources.
Expand All @@ -95,6 +95,7 @@ while retaining the read-only scopes for the other resources.

Team Based Access to Device Groups
----------------------------------

By default, a user can access:

1. device groups they created,
Expand All @@ -104,19 +105,19 @@ By default, a user can access:
A factory admin can grant a user access to any device groups.
To do so, an admin should:

1. add a user to a team if is not a team member yet;
1. add a user to a team if they are not yet a team member;
2. add a device group to the team;
3. set ``devices:*`` scopes for the team.
3. set the ``devices:*`` scopes for the team.

As a result, the user will get a permission to perform the set actions over the group and its devices.
As a result, the user will get permission to perform the set actions over the group and its devices.

.. note::

The ``devices:*`` scopes determine actions team members can perform over device groups and their devices.
The ``devices:*`` scopes determine the actions team members can perform over device groups and their devices.

* ``devices:read`` - view device/group details and its configuration.
* ``devices:read-update`` - view and modify device/group details and its configuration, including config file deletion.
* ``devices:delete`` - delete device/group.
* ``devices:read`` - permission to view the details and configuration of a device/group.
* ``devices:read-update`` - permission to modify device/group details and configuration, including config file deletion.
* ``devices:delete`` - Ability to delete device/group.

See :ref:`API Scopes <ref-scopes>` for more details on the scopes.

Expand All @@ -125,15 +126,15 @@ Example

A Factory has two teams in place and one device group, ``test-lab-devices``.

Members of the "read-only-users" team have read-only access to all factory resources with one exception—device groups and devices.
They can see only the ``test-lab-devices`` group and devices included into it.
Members of the "read-only-users" team have read-only access to all factory resources.
They can only *see* the ``test-lab-devices`` group and devices included into it, they can not make any modifications.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I feel this is still a bit misleading. They can see all devices, but can only make modifications to devices in this device group. With the current sentence, they can still think they should be able to only see the devices in this device group.


.. figure:: /_static/userguide/account-management/team-with-group-and-read-access.png
:align: center
:alt: "read-only-users" scopes: read-only team with a device group

The "lab-dev-users" team includes ``devices:read-update`` scope.
Therefore, members of this team can modify the ``test-lab-devices`` group and its devices.
Therefore, members of this team can *modify* the ``test-lab-devices`` group and its devices.

.. figure:: /_static/userguide/account-management/team-with-group-and-write-access.png
:align: center
Expand Down