{"action":"created","issue":{"url":"https://api.github.com/repos/foosel/OctoPrint/issues/1110","labels_url":"https://api.github.com/repos/foosel/OctoPrint/issues/1110/labels{/name}","comments_url":"https://api.github.com/repos/foosel/OctoPrint/issues/1110/comments","events_url":"https://api.github.com/repos/foosel/OctoPrint/issues/1110/events","html_url":"https://github.com/foosel/OctoPrint/issues/1110","id":115501187,"number":1110,"title":"[Request] Create a more granular permission system","user":{"login":"foosel","id":83657,"avatar_url":"https://avatars.githubusercontent.com/u/83657?v=3","gravatar_id":"","url":"https://api.github.com/users/foosel","html_url":"https://github.com/foosel","followers_url":"https://api.github.com/users/foosel/followers","following_url":"https://api.github.com/users/foosel/following{/other_user}","gists_url":"https://api.github.com/users/foosel/gists{/gist_id}","starred_url":"https://api.github.com/users/foosel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/foosel/subscriptions","organizations_url":"https://api.github.com/users/foosel/orgs","repos_url":"https://api.github.com/users/foosel/repos","events_url":"https://api.github.com/users/foosel/events{/privacy}","received_events_url":"https://api.github.com/users/foosel/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/foosel/OctoPrint/labels/difficulty:challenging","name":"difficulty:challenging","color":"bfdadc"},{"url":"https://api.github.com/repos/foosel/OctoPrint/labels/type:request","name":"type:request","color":"0052cc"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-11-06T13:04:23Z","updated_at":"2015-11-09T07:43:22Z","closed_at":null,"body":"At the moment OctoPrint only distinguishes between three user roles if ACLs are enabled:\r\n\r\n  * **Guests/Anonymous**: May view the current status, including progress, file being printed, gcode preview, webcam, terminal output. May also download timelapses and uploaded files.\r\n  * **Users**: All of the above, plus may control the printer, upload files, start/pause/cancel jobs, send commands to the printer.\r\n  * **Admin**: All of the above, plus can view and manage settiings, update the installation, install plugins.\r\n\r\nAs various tickets (e.g. #1109 and #640) and posts on mailinglist etc have shown, that is not granular enough for many usage scenarios.\r\n\r\nInstead there should be a more granular permission system that allows:\r\n\r\n  * giving or revoking access to individual functionality per user group (that means both in the UI and on the API endpoints)\r\n  * possibly allowing adding custom user groups for more complex usage scenarios\r\n\r\nIn order to do this we need to\r\n\r\n  * model user groups vs. permissions on a per-feature-level (roles)\r\n    * determine which roles need to be recognized for vanilla OctoPrint and model them\r\n    * add a way for plugins to define individual roles that can be offered for the user to attach to groups\r\n  * create some way to store user groups vs. associated permissions (currently that stuff is hard coded)\r\n  * add a permission editor\r\n  * document permissions in API documentation (\"needs user group with role X\")\r\n  * clearly communicate the limits of the permissions in the interface - we cannot prevent people from viewing the webcam if the URL is known since access to the webcam is provided by the webcam server, OctoPrint merely embeds it, so it cannot control access to it, that needs to be done by the webcam server"},"comment":{"url":"https://api.github.com/repos/foosel/OctoPrint/issues/comments/154986714","html_url":"https://github.com/foosel/OctoPrint/issues/1110#issuecomment-154986714","issue_url":"https://api.github.com/repos/foosel/OctoPrint/issues/1110","id":154986714,"user":{"login":"foosel","id":83657,"avatar_url":"https://avatars.githubusercontent.com/u/83657?v=3","gravatar_id":"","url":"https://api.github.com/users/foosel","html_url":"https://github.com/foosel","followers_url":"https://api.github.com/users/foosel/followers","following_url":"https://api.github.com/users/foosel/following{/other_user}","gists_url":"https://api.github.com/users/foosel/gists{/gist_id}","starred_url":"https://api.github.com/users/foosel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/foosel/subscriptions","organizations_url":"https://api.github.com/users/foosel/orgs","repos_url":"https://api.github.com/users/foosel/repos","events_url":"https://api.github.com/users/foosel/events{/privacy}","received_events_url":"https://api.github.com/users/foosel/received_events","type":"User","site_admin":false},"created_at":"2015-11-09T07:43:22Z","updated_at":"2015-11-09T07:43:22Z","body":"Fun fact: movement controls are disabled while printing for that exact reason."}}