Allow users to have multiple roles

[robin-thoni]

I absolutely love the idea a role can be active or not depending on a template. But I don't really get this Fallback Role mechanism.
Couldn't you simplify this, and simply assign multiple roles to each users?

[SamAthanas]

Currently the template runs each time a user with that role invokes an action. If that template is true, the role is used. If its false, then the permissions are inherited from the fallback role. There are some limitations to this though, as im sure you've discovered.

If we had a way to prioritize roles and assign multiple to a single user, the system could fall through each role that has a false template instead of using the fallback role mechanism.

I assume this is something along the lines of what you were thinking?

[Droninator]

• Note: just now finding this project, so sorry if I misunderstood the way it's currently implemented.

That would be similar to how Access Control Lists work in networking.
Each list is default allow or default deny.
If multiple lists apply, the packet would need to pass an allow gate at every level to get routed.

The same would work here, so long as all roles assigned would allow the action, the action passes. If any of them would deny the action, it fails.

Alternatively, you could structure it similar to permissions groups in Radius and Active Directory servers. There is a blanket deny policy across everything and each permissions group is a list of items where access is granted. In this case, if any of the groups would allow access, the action passes, but if none of them grant access, the action fails.

I would imagine using this second method may allow for a simpler implementation method as well, as you'd basically just need to check if any applied policies allow access rather than run multiple templates.
You could apply tags to identify what you want to control access to (services, groups, dashboards, etc...), and adding the permissions group to a user could add the relevant tags to that user account in a database. To check if access should be granted, you'd just have to see if the tag for the area or item is attached to the account.

One side note on this, if going this route it would likey be beneficial to allow multiple tags per item (ex: [area], [device], [entity]), as it would allow you to restrict users based levels rather than needing to do it per entity.
This way, if the user has been granted access to, for example, the kitchen, they would be automatically able to access new items added to the kitchen without needing to update the access control policies.
The same could apply with automation, scripts, devices, etc...
It allows the admins to get as granular as they need to without requiring them to adjust permissions for every single entity.

Additionally, as a feature to extend off of this, it would be cool to have a way to filter the list to everything related to somthing to make it easier to allow everything that's required for a specific area or function.
For example, all items utilized by a specific dashboard.
Although, this might be a bit difficult to implement, as you would have to recurse through every entity, device, script, etc... and all items under those to find everything.
In that case, it might be better to have some sort of inheritance system where permission to access the dashboard allows access to all items used by it in that context.
Not sure what a good method for this would be though, just my thoughts on the matter.