Plugins and modules governed by an access list per account and per group, replacing “Each person may change it” #886

New issue

Closed

opened 2026-10-10 16:11:44 +00:00 by tiagoagueda · 1 comment

tiagoagueda commented

2026-10-10 16:11:44 +00:00

Owner

Deprecate the Each person may change it checkbox in favour of an access list on plugins and modules, managed only by administrators, per username or per group.

What exists today

PluginPolicy (plugins/models.py:88): states available / unavailable / forced on / forced off, for the instance (person null) or one account (person set).
Each person may change it maps to available vs forced on (core/server_views.py:1287-1343). For built-ins it has no effect: a shipped plugin is never the person's (policy._decide :195-200, #200), so the box only matters for installed third-party plugins.
Django's groups and permissions are not used anywhere (only the admin's fieldsets list them); authorisation is is_staff or ownership. #268 (1.0.0) is the umbrella for several people on one instance.

What would change

Groups (Django's Group, managed on a new Server settings → People card) and an access rule per plugin: which accounts and groups may use it, and which may change its settings.
The policy's decision reads the rules (account rule over group rule over instance default); the checkbox goes, migrated: may change it → a rule everyone may use and switch, forced → everyone uses, nobody switches.
The Settings button's not authorised state (#885) reads the same rules.

Decisions

Django groups or Postulo's own. Recommended: Django's Group, already in the schema and the admin.
Order with #268. Recommended: after #268 settles what accounts share; this issue is the plugins' part of it.

Checked against main at 8c3d03570. From the maintainer's improvements list of 2026-10-07 (plugins).

Deprecate the *Each person may change it* checkbox in favour of an access list on plugins and modules, managed only by administrators, per username or per group. ## What exists today - `PluginPolicy` (`plugins/models.py:88`): states available / unavailable / forced on / forced off, for the instance (`person` null) or one account (`person` set). - *Each person may change it* maps to available vs forced on (`core/server_views.py:1287-1343`). **For built-ins it has no effect**: a shipped plugin is never the person's (`policy._decide :195-200`, #200), so the box only matters for installed third-party plugins. - Django's groups and permissions are **not used** anywhere (only the admin's fieldsets list them); authorisation is `is_staff` or ownership. #268 (1.0.0) is the umbrella for several people on one instance. ## What would change - Groups (Django's `Group`, managed on a new *Server settings → People* card) and an access rule per plugin: which accounts and groups may **use** it, and which may **change its settings**. - The policy's decision reads the rules (account rule over group rule over instance default); the checkbox goes, migrated: *may change it* → a rule *everyone may use and switch*, forced → *everyone uses, nobody switches*. - The Settings button's *not authorised* state (#885) reads the same rules. ## Decisions - **Django groups or Postulo's own.** Recommended: Django's `Group`, already in the schema and the admin. - **Order with #268.** Recommended: after #268 settles what accounts share; this issue is the plugins' part of it. Checked against `main` at `8c3d03570`. From the maintainer's improvements list of 2026-10-07 (plugins).

tiagoagueda added this to the 1.0.0 milestone

2026-10-10 16:11:44 +00:00

tiagoagueda added the

labels

2026-10-10 16:11:44 +00:00

tiagoagueda referenced this issue

2026-10-10 16:11:55 +00:00

Every plugin and module: a Settings button under its switch #885