Overview

Implement ability to configure security for user fields to prevent global admin, project admin, practice area lead, and team member from having read, update, or create permissions to fields that are sensitive. These roles correspond to adminGlobal, adminProject, practiceLead, and memberTeam permission types.

Details

This issue, when implemented, will enable specifying permissions for the /users and /me endpoints based on a the role/permission type, project, and study a user is assigned to.

End points

• /user - end point for updating, deleting, reading, and creating users
• /me - end point for updating and seeing data about yourself
• /eligble-users - end point for assigning a user to the team that is not already assigned. See issue Implement field configurable security for global admin, project admin, practice area lead, and team member #346 for more details. This will not be implemented as part of this issue.

cru_permissions.py will have a "cru" permission list for each role (global admin, project admin, practice area lead, and team member. The cru permission list will specify for each field whether user can specify when creating, read, or update the field.

Note: This issue is considered completed when the ability to configure is implemented and a permission is specified for each field for each role, even if the specification has not been verified. See issue #xxx for verifying specification.

Here is an example of cru_permissions for project lead:

_cru_permissions[admin_project] = {
    "uuid": "R",
    "created_at": "R",
    "updated_at": "R",
    "is_superuser": "R",
    "is_active": "R",
    "is_staff": "R",
    # "is_verified": "R",
    "username": "R",
    "first_name": "RU",
    "last_name": "RU",
    "gmail": "RU",

Since a project admin cannot create a user, none of the fields will include a "C". Only global admin can create a record.

Technical Notes

• serializer.py can be used to restrict what users can read
• views.py can be used to restrict what can be included in a request for updating and creating

Action Items

• Implement code
• Document class methods
• Create markdown documentation that explains how security works
• Write tests