Organization collective

[mitchelljkotler]

• Adds an invitation model for organizations to join organization, similar to invitations for users
• Adds two fields to organizations:
  • collective_enabled - this enables the organization to have children or member organizations
  • share_resources - this enables the organization's children and member organizations to share resources with it
    The actual resource sharing happens on the client side
• Add fields to organization API
  Clients need access to organization relationships (parents and groups) along with share_resources to properly implement sharing resources. These fields are added to the API
• Email templates - these can be filled in later, they need to refer to views which have not been written yet
  • org_invitation.html - corresponds to invitation.html
  • org_join_request.html - corresponds to join_request.html

Did we decide that there would be no automatic verification sharing? If so we can remove that method.

[allanlasser]

Yep, we decided to not include automatic verification at this point. However, this decision was made in the context of scoping the changes we need to apply. Since you've already added this in code, I don't think it's a problem to keep it, since this meets a requirement we previously established as useful, but optional for a first pass.

[allanlasser]

I can contribute email copy for this situation, but it'd be helpful to know the context. When is this sent, to whom, and why?

[mitchelljkotler]

This email will be sent to the organization admins (of the Parent/Group org) when a Child or Member organization requests to join a Parent or Group organization.

[allanlasser]

Making sure I understand this correctly:

1. If I belong to an org, that org will be included in my user data payload.
2. Since my org is a member of a higher org, share_resources will be false and groups will have the UUID of the org it's a member of.
3. When I fetch that groups org by UUID, it will have share_resources = true

So, as a client I'd need to fetch and check all entities in groups to see whether resource sharing is enabled?

[mitchelljkotler]

This is correct

[allanlasser]

In that case, what do you think about expanding the parent and groups values to include share_resources? At the very least, this would eliminate the need for clients to make blind network requests for organizations just to know whether or not they have resources available to share.

For example, let's imagine I'm building a small client service and I want to offer some kind of shared group resource. As is, I'd need to make a request for every org in both sets in order to determine the shared resources available—some of those requests would be unnecessary. If I at least know if a parent or group is sharing resources, I can make a more targeted and efficient set of requests for just the organizations that share resources.

[allanlasser]

Mitch and I talked about taking an approach where we serialize and send all data about parents and group organizations to clients, so that they can update all their records just by receiving the webhook.

[allanlasser]

Related PRs, for reference:

• Add resource sharing for organization collectives muckrock#2104
• Add resource sharing for organization collectives documentcloud#355
• Add resource sharing for organization collectives squarelet-auth#4

[duckduckgrayduck]

It would be nice if I could add an invitation for an org to join the parent org as a child via the backend for testing purposes.

Running from the django shell, I sent an invite from MuckRock (parent) to MuckRock Child Organization to join the organization. I received an email that only said "Invitation to join MuckRock" with a body that said "TK".

I can see that the invite was successfully created in the django backend, but it also gives me no way to actually approve it the backend. I seemed not able to send an invite from MuckRock Child Org as the sender to the parent to indicate the child <-> parent relationship. I can imagine situations where this may seem useful, similar to a user requesting to join their organization. It may not be in the scope of this PR.

Again going from the backend, I accepted the earlier invitation. It correctly changed the parent of MuckRock Child to MuckRock and added MuckRock child to the list of children for MuckRock. Rejecting a request similarly worked.

There is a broken relationship however, in that MuckRock can both be the parent and child to MuckRock Child Organization. This should be resolved. We should enforce that a parent of a child org cannot also be the child of said org

[mitchelljkotler]

It would be nice if I could add an invitation for an org to join the parent org as a child via the backend for testing purposes.

Running from the django shell, I sent an invite from MuckRock (parent) to MuckRock Child Organization to join the organization. I received an email that only said "Invitation to join MuckRock" with a body that said "TK".

I can see that the invite was successfully created in the django backend, but it also gives me no way to actually approve it the backend. I seemed not able to send an invite from MuckRock Child Org as the sender to the parent to indicate the child <-> parent relationship. I can imagine situations where this may seem useful, similar to a user requesting to join their organization. It may not be in the scope of this PR.

Again going from the backend, I accepted the earlier invitation. It correctly changed the parent of MuckRock Child to MuckRock and added MuckRock child to the list of children for MuckRock. Rejecting a request similarly worked.

There is a broken relationship however, in that MuckRock can both be the parent and child to MuckRock Child Organization. This should be resolved. We should enforce that a parent of a child org cannot also be the child of said org

Thanks - the invitations do not have a UI yet. I added them first and then realized resource sharing was the top priority. We will be setting up the relationships manually for now, so we ensuring parent relationships are not circular can be done later.

[duckduckgrayduck]

Another related PR that needs to be merged in:
MuckRock/documentcloud-frontend#1269