Permissions documentation

[stefan-niedermann]

Hello there 👋

Status Quo

According to the API documentation, a shared table can have the following permissions:

• READ
• WRITE
• CREATE
• UPDATE
• MANAGE

Interpretation

My interpretation is, that READ, CREATE, DELETE and UPDATE are considered when manipulating table contents, while MANAGE is needed for changing the table name or emoji.

Questions

I have a few questions about this:

1. What is the purpose of the READ permission? Is there a valid scenario where users share a table, which can be updated but not show the content?
2. Why is CREATE and UPDATE a different permission?
3. Which permission is used to allow or forbid resharing?
4. Which permission is used for manipulating (create, update, read and delete columns? Is all of this combined within MANAGE?
5. Can a sharee delete a table if the permission MANAGE is granted?

Proposals

Just an idea to change the permissions to be more clear:

1. Drop READ - When a table is shared, it is obvious (to me) that the sharee can read the information as most lowest permission
2. Combine UPDATE, CREATE and DELETE into a new WRITE permission

cc @datenangebot

[datenangebot]

Hi @stefan-niedermann ,

you can find an overview about permissions in this spreadsheet: https://github.com/nextcloud/tables/blob/main/docs/permissions-matrix.xlsx

Questions

I have a few questions about this:

1. What is the purpose of the `READ` permission? Is there a valid scenario where users share a table, which can be updated but not show the content?

Yes, it should be possible that users can create new rows without reading existing ones. E.g. requesting a support issue.

2. Why is `CREATE` and `UPDATE` a different permission?

Because it might be interesting if you are allowed to start a new workflow/dataset or just edit and work on an existing one.

3. Which permission is used to allow or forbid resharing?

For now resharing is not allowed at all.

4. Which permission is used for manipulating (create, update, read and delete _columns_? Is all of this combined within `MANAGE`?

Yes, for now you have to be the manager or need manage permission.

5. Can a sharee delete a table if the permission `MANAGE` is granted?

No, look at the spreadsheet, it's only possible for the owner. (Maybe that's not what we need...?!)

Proposals

Just an idea to change the permissions to be more clear:

1. Drop `READ` - When a table is shared, it is obvious (to me) that the sharee can read the information as most lowest permission

No, like described above.

2. Combine `UPDATE`, `CREATE` and `DELETE` into a new `WRITE` permission

No, like described above.

Sorry for beeing such nitpicking, but from my experience we need all this fine granularity permissions.

[stefan-niedermann]

Totally fine, explanations make sense 🙂