Development blueprints

• Permission management
  • Relevant domain examples
    • Permission-related needs
    • Examples of operations
    • Organization specific permission management cases
    • Workflows and additional capabilities
    • Conceptual constraints
  • Permission management vocabulary
    • Scope
    • User
    • Group
    • Resource
    • Role
    • Operation
    • Permission
  • Catalog of permission use cases
    • Public workspaces
    • Private workspaces
    • Signing a package
    • Uploading an artifact to a workspace
    • Run the Debian pipeline workflow
    • Debian pipeline for embargoed Security
    • Publish a package to a distribution (sid-like case)
    • Publish a package to a distribution (stable-like case)
    • Maintain a personal repository
    • Syncing group membership with external sources
  • High level design choices
    • Scoping for workspaces
    • Scoping for groups
    • Scoping for users
    • SAAS hosting model
    • One workspace per distribution
  • User and group structure
    • Users and scopes
    • Groups
    • No automatic personal collections
  • High level implementation plan
    • Checking permissions
    • Permissions are checked only on groups
    • Permission for the anonymous user
    • Permission for any logged in user
    • Sharing workspaces across scopes
    • Application context
    • Workspaces and Workflows
    • Initial roles
  • Proposed implementation changes
    • Implement Scopes
    • Implement Group
    • Implement application context
    • Add roles for existing use cases
    • Encode permissions
    • Add permission checks at the API boundary
    • Add permission checks at the model boundary
• Permission predicates
  • Mapping the problem
    • Roles can be delegated
    • We do not only check roles
    • We test permissions on individual resources
    • We list resources for which we have permissions
    • Testing individual resources
    • Filtering resources
    • Caching and invalidation
  • Implementation proposal
    • Predicate API
      • Checking individual resources
      • Filtering resources
    • Behind the scenes
• UI views
  • Base layouts
    • base
    • base_rightbar
  • UI widgets
    • UI shortcuts
    • Sidebar items
• Uploading packages
  • Pipeline considerations
• Task configuration
  • Collection debusine:task-configuration
    • Bare data debusine:task-configuration
    • About templates
  • Design considerations
    • Workflow vs task feature
    • Integration with dynamic_data
    • Algorithm to apply the configuration
  • Implementation plan
• Task statistics
  • Store runtime statistics in WorkRequest
    • RuntimeStatistics model
  • Collection debusine:task-history
    • Bare data item: debusine:historical-task-run
  • New action record-in-task-history
  • Open question: how and where to use the statistics
  • Implementation plan
• Build instructions
  • Desired features
    • Control of architectures
    • Host architecture for arch-all builds
    • Control the build backend and the associated build environment
    • Control DEB_BUILD_PROFILES and DEB_BUILD_OPTIONS
    • Control workers assigned for specific packages/tasks
    • Control packages tested during autopkgtest of reverse dependencies
  • Proposed changes
    • Changes to the sbuild workflow
    • Changes to the sbuild task
    • Changes related to the worker requirements feature
• Transitioning to scoped URLs
  • Fallback scope introduced in migrations
  • Transitioning web URLs
  • Transitioning APIs
• Debian pipeline
  • CheckInstallability task
  • Confirm task
  • API changes
  • UI changes
• User interface to monitor workflows
  • User story / requirements
    • Runtime status of the workflow
  • Expected changes
• URL redesign
  • Current URL structure
  • Use /-/ as path to non-data URL components
  • Leave /api/ as a toplevel special case
  • Remove /workspace/
  • URLs that should not be scoped
  • Restructure accounts
    • work-request/
  • Artifact URLs
    • /<scope>/artifact/<int:artifact_id>/
    • /<scope>/artifact/<int:artifact_id>/file/<int:file_in_artifact_id>/<path:path>
    • /<scope>/artifact/<int:artifact_id>/raw/<int:file_in_artifact_id>/<path:path>
    • /<scope>/artifact/create/
    • /<scope>/artifact/<int:artifact_id>/download/*