Classification user groups authorization policies

[yuenmichelle1]

Introduces classification user group authorization policies. See wiki for Authorizations info https://github.com/zooniverse/eras/wiki/API-Callout-Examples#authorizations-1

But if you do not feel like clicking ^ link, see below:

Authentication

Dependent on what you are querying. See below for more info

Authorizations

Permissions are dependent on 3 factors (unless you are a panoptes_admin, then you have full permission):

1. what stats requests you are querying from ERAS (group aggregate stats vs individual stats breakdown),
2. the user group's stats visibility level,
3. and who you are related to the group

If you are querying group aggregate stats (i.e. individual_stats_breakdown is false or not a parameter in your request):

• If the user_group's stats visibility level is public_show_all
  • anyone can view these stats (No auth required)
• If the user_group's stats visibility level is public_agg_show_ind_if_member
  • anyone can view these stats (No auth required)
• If the user_group's stats visibility level is public_agg_only
  • anyone can view these stats (No auth required)
• If the user_group's stats visibility level is private_show_agg_and_ind
  • querying user is either a group_admin or a group_member (Auth required)
• If the user_group's stats visibility level is private_agg_only
  • querying user is either a group_admin or a group_member (Auth required)

If you are querying individual stats breakdown (i.e. individual_stats_breakdown is true):

• If the user_group's stats visibility level is public_show_all
  • anyone can view these stats (No auth required)
• If the user_group's stats visibility level is public_agg_show_ind_if_member
  • Only group_members and group_admins can see these stats (Auth required)
• If the user_group's stats visibility level is public_agg_only
  • querying user is a group_admin (Auth required)
• If the user_group's stats visibility level is private_show_agg_and_ind
  • querying user is either a group_admin or a group_member (Auth required)
• If the user_group's stats visibility level is private_agg_only
  • querying user is either a group_admin (Auth required)

[zwolf]

These calls out to panoptes can be memoized in order to prevent repeats by adding @queried_user_group ||= to the return line. It doesn't seem like either one of these get called more than once intentionally, but it's something to keep in mind so that you don't repeat API requests unnecessarily.

[zwolf]

What is this protecting against? Does something ask the client this somewhere?

[yuenmichelle1]

Yeah..we don't need this line. We are not asking the the client this anywhere.