Test field level permissions

[anandramakris]

Overview

We are planning on including field-level security for tables. The required permissions need to be tested before implementation.

Action Items

• implement code needed for FLS (tables, possibly models)
  • create tables
  • add test data
• test Practice Lead project
• create test cases for FLS

Resources/Instructions

• PostgreSQL documentation for field-level security policies
• Django multitenancy
• Use cases and tests for FLS feasibility: Discuss our requirements for permissions #150 (comment)
• Tables and test data
• Ethan's proposal and documentation on the wiki: https://github.com/hackforla/peopledepot/wiki/Security:-Field-Level-Proposal-(using-Github-Copilot)

[ExperimentsInHonesty]

@anandramakris, @Neecolaa and I just finished writing - Use cases and tests for FLS feasibility: #150 (comment), and we have added the link to this comment above under Resources. Let us know in a comment here if you have any questions.

[anandramakris]

Have attempted to implement the permission table and the test data in the field-level-permissions branch.

• https://github.com/hackforla/peopledepot/tree/field-level-permissions
  • test data: https://github.com/hackforla/peopledepot/blob/field-level-permissions/app/core/tests/conftest.py
  • https://github.com/hackforla/peopledepot/blob/field-level-permissions/app/core/models.py

[ExperimentsInHonesty]

@anandramakris and what was the outcome?

Last time we spoke you were going to setup the data and then feed ChatGPT the prompt with the data so that it could provide a more complete solution. Did you try that, and if so, please cut and past the conversation into this issue.

[anandramakris]

Had forgotten to try it, so I did it first thing this morning.

Attached is a link to the chat, in which I asked in order about:

1. Testing the classes,
2. Using pytest with the data,
3. Specifically testing each value of PermissionType.
   test-permissions.pdf

[ExperimentsInHonesty]

@anandramakris Please provide update

1. Progress: "What is the current status of your project? What have you completed and what is left to do?"
2. Blockers: "Difficulties or errors encountered."
3. Availability: "How much time will you have this week to work on this issue?"
4. ETA: "When do you expect this issue to be completed?"
5. Pictures or links* (if necessary): "Add any pictures or links that will help illustrate what you are working on."

• remember to add links to the top of the issue if they are going to be needed again.

[anandramakris]

Asked ChatGPT about field-level permissions in Django, giving the test cases for memberGeneral and memberProject as a basic prompt. Result is attached as pdf.
django-fieldpermissions.pdf

Note: the transcript is in pdf becasue the original html file is not accepted by github.

[ExperimentsInHonesty]

@ethanstrominger Please do a draft PR, we need to see the file permissions (how they show up in the models) so that we can revise our documentation on who should have which permissions.

[ethanstrominger]

Moved to ice box so that work on #331 can inform the documentation - the documentation that is written for #331 might be sufficient. The implementation of #331 will include testing of everything implemented.

[ethanstrominger]

Bonnie/Ethan: discuss