Use user groups and permissions to manage access to some features

[pktiuk]

My actions before raising this issue

• Read/searched the docs
• Searched past issues

Expected Behaviour

Access to some features (like Analytics) or making tasks not visible to all users should be managed in a bit more systematic way.
Instead of basing on flag in user Model there should be some default groups (or permissions) which define access to these features.
(Like group analytics for people which need to see grafana dashboards or limited access for people who should see only tasks assigned to them etc).

Current Behaviour

Now there is no elastic system to manage this.

Other

This issue seems to be linked with: #6125

If the CVAT team finds this idea useful I would be interested in implementing this.

[pktiuk]

I found also in docs sentence Available roles are: user (default), admin, business, worker., but there is no a single place where it is properly described where what is the purpose of thee groups, because anyway most of the permissions depend on status flags.

[bsekachev]

Basically, CVAT uses Open Policy Agent rules to manage resources.
These groups does not really play role (maybe except for "admin").

[pktiuk]

@bsekachev
Thank you for the answer.

Is there anything in docs about using Open Policy Agent in CVAT? (I looked, but I can't find anything)

[bsekachev]

https://www.cvat.ai/post/cvat-open-policy-agent

[pktiuk]

Thanks

[pktiuk]

@bsekachev

These groups does not really play role (maybe except for "admin").

Are you sure about that? I was looking at some .rego rules used by OPA and there are many places.

allow {
    { utils.UPDATE_STATE, utils.UPDATE_ANNOTATIONS, utils.DELETE_ANNOTATIONS,
      utils.IMPORT_ANNOTATIONS, utils.UPDATE_METADATA }[input.scope]
    utils.is_sandbox
    utils.has_perm(utils.WORKER)
    is_job_staff
}

They are used for something, I don't see any explanation in docs what is the purpose of these groups.
There is nothing about them neither in docs nor in original PR: #3788

[pktiuk]

@bsekachev
I found an empty docs page, which was supposed to have descriptions of these groups: https://opencv.github.io/cvat/docs/administration/advanced/iam_system_roles/