Module project_policy 

Need-to-know policy of a restricted project group (issue #151, step 1): how administrators who are not members read the group.

• implicit (also: no policy row) – administrators read every restricted group, as before;
• with_reason – the group is hidden from such an administrator until they open a time-limited elevation with a written reason (audited, the managers are notified, listed on the group page);
• none – administrators manage the group (members, policy) but read nothing in it unless they are members; adding oneself is audited and notifies the other managers.

The rule itself is in services::access::hidden_of_user: it fills Actor::hidden_projects for administrators too, so every existing guard applies without a check in any handler.

Structs

AccessSettings

The interface switches, the log settings and the review interval of a group.

AccessUpdate

A change of the switches, log settings and review interval; None leaves a value as it is.

Elevation

An administrator’s time-limited access to a group.

Interfaces

Which interfaces are allowed for a group (all true = today’s behaviour).

PolicyPerson

A person named in a review policy.

PolicyView

The policy of a group as shown to its managers.

ReviewPolicyInput

What a manager submits.

ReviewPolicyView

How changes touching a group are reviewed. The default (no minimum, nobody required, no role group) is “every reviewer approves”.

RoleGroup

The role group of a review policy.

Enums

Interface

A channel through which data of a restricted group can leave the web UI. Each can be switched off per group; a switched-off interface treats the group as non-existent (the usual “not found”).

Constants

ELEVATION_MINUTES

How long an administrator’s elevation lasts.

MAX_REASON_CHARS

Longest accepted reason (also the column’s CHECK).

MAX_REQUIRED_REVIEWERS

Most people a group can name as required reviewers.

MAX_REVIEW_INTERVAL_DAYS

Longest accepted access review interval (ten years).

MIN_REASON_CHARS

Shortest accepted reason (a word is not a reason).

Functions

denied_groups

The restricted groups for which at least one of interfaces is switched off. A group that is not restricted is never listed: the switches build on the restriction.

elevate

An administrator opens a time-limited elevation on a group whose policy is with_reason; until it expires the group is visible to them like to a member, with every guard.

end_elevation

Ends the actor’s running elevation of a group early.

get

The policy of a group (managers and administrators; a group that is hidden from everybody else answers “not found”).

get_review_policy

The review policy of a group (anybody who may see the group; an administrator maintaining a group hidden by the need-to-know policy too). A role group the actor may not see is left out.

narrow

The actor as it is seen through interfaces: groups that switched one of them off are hidden. One cheap query; without a policy nothing changes.

package_actor

For downloads of a whole structure: the root item’s group must allow packages (403, the actor reads it anyway), and the returned actor does not see the items of groups that do not, so they are left out like restricted items of non-members.

set_access

Changes the interface switches and the log settings of a restricted group (managers and administrators).

set_admin_read

Sets how administrators read a restricted group (managers and administrators).

set_review_policy

Sets the review policy of a group.

settings

The switches and log settings of a group (defaults without a policy row).