Allow senior staff and managers to edit Bugzilla components

[emceeaich]

RFC to distribute Bugzilla administration duties

[emceeaich]

Issue #6

[emceeaich]

Suggestion: if a member of a magic group posts a bug to a particular component, could we mint and send a one-time capability URL to the reporter which would let them make the change?

That way we'd have the public record of the change in the bug, and non-admin staff don't have long-lived permissions.

[mitchhentges]

Hmm, that's interesting 🤔

and non-admin staff don't have long-lived permissions.

Since the non-admin staff are part of that magic group, wouldn't that count as still having a long-lived permission? It sounds like it's like a "permission proxy" such that the non-admins still have the ability to make changes, they just require one extra step (creating the bug) to perform the operation

[emceeaich]

Thinking about this more: I think the "permission proxy" design would be reasonable if it were difficult for us to restrict the components which someone with `editcomponets` has access to. That way someone couldn't just browse through the component editor and make one change after another. The additional step of requesting the capability would mitigate the harm they could do.

…

On Fri, Feb 14, 2020 at 1:35 PM Mitchell Hentges ***@***.***> wrote: Hmm, that's interesting 🤔 and non-admin staff don't have long-lived permissions. Since the non-admin staff are part of that *magic group*, wouldn't that count as still having a long-lived permission? It sounds like it's like a "permission proxy" such that the non-admins still have the ability to make changes, they just require one extra step (creating the bug) to perform the operation — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#7?email_source=notifications&email_token=ACNND7E2Q7VURK2MU4RBEEDRC4FBRA5CNFSM4KU6M4V2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEL2QDKQ#issuecomment-586482090>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ACNND7EQ5Q2EHWCAJDPKUTDRC4FBRANCNFSM4KU6M4VQ> .

[mitchhentges]

The additional step of requesting the capability would mitigate the harm they could do.

I don't quite understand this - the thing that sends a one-time capability URL sends it instantly, right?
If I'm grokking this correctly, this will mitigate harm by adding busywork to making changes. If someone is actively malicious, they could script it (even if we added timeouts to the capability-URL logic, it'd be a bit of a cat'n'mouse game).

---

Stepping back a bit here, my guess is that the core issue here is that we want to restrict the amount of people that have access to the editcomponents permission. At the same time, we don't want to be the only people that can edit components since that forces us to keep doing admin busywork for all projects.

Perhaps this will be nicely resolved by the "Extend self-service capabilities" roadmap item? It sounds like that means there will be a sort of "scoped editcomponents" permission that will allow product admins to have control over just their projects. Will "Extend self-service capabilities" make the need for this "permission proxy" obsolete?

[emceeaich]

I don't quite understand this - the thing that sends a one-time capability URL sends it instantly, right?

It doesn't have to. It could be sent to the Bugmail address of the user, or indirectly accessed through the users' profile.

It sounds like that means there will be a sort of "scoped editcomponents" permission that will allow product admins to have control over just their projects.

That would obviate most of the need for this.

[emceeaich]

To start winding up the discussion, I'd like to allow a pilot group of users to have editcomponents through a group membership so we start reducing admin involvement, and build understanding of what "extending self-service capabilities" will entail.

[globau]

We should ensure we have reasonable step-by-step documentation for how to make common changes.

[dklawren]

You can grant editcomponents on a per-product basis using the group access controls UI of a product page.

https://bugzilla.mozilla.org/editproducts.cgi?action=editgroupcontrols&product=Core