I have started looking into a feature where users have requested for custom roles. The roles can then be assigned permissions. Here's what I think how it can be done:
Create a framework for roles based access control.
Allow adding/editing/deleting roles from UI.
User management dialog can be converted to a tab to get extra space for other stuff.
pgAdmin can have some predefined permissions. The permissions can then be used to validate at the API levels and UI.
New permissions cannot be added from UI as it will require code changes. They can be added based on user requests.
Admin can allow these permissions to the roles and roles can be assigned to users.
Permissions will be used to
Admin role remains static with no changes allowed.
Let me know your thoughts on this. If everything looks good then I will proceed.
What permissions would we support initially?
Based on https://github.com/pgadmin-org/pgadmin4/issues/7310, we can start with not allowing users to register a server. We'll start 1 or 2 may be, the intention is to create a framework which will allow us to keep adding permissions on future requests.
The reason I ask is that there's no point in creating a framework if we just end up with a single permission for adding/removing servers. I think it makes sense to be sure there are likely to be other permissions before committing to something likely to be a lot more complex than just adding an attribute to a user.
I understand, but there have been many user requests for custom roles. I agree that adding a complex thing like RBAC just for one single permission is an overkill. But based on my past experience - users will come up with more permissions once they see that they can tweak the permissions now.
