API For managing project membership & roles

[mihow]

Summary

We need a way for project managers to add members to their project and assign them roles

Detailed Description

#693 introduces a backend for permissions & roles but these can currently only be assigned by superadmins in the Django admin.

#639 discusses some ideas of where to put project settings.

My suggestion is to keep this simple and add dedicated button & modal for managing project members. On the project detail view. But multiple paths to get there is a good idea.

[mihow]

@annavik I stubbed this out but feel free to complete it.

[annavik]

Thanks @mihow, I thought about this a bit today. I would like to first do #753, then do this as the next step. What do you think?

[mihow]

@annavik volunteered to list out the endpoints & actions you need to implement this

[annavik]

Required actions

• List members for a project
• Add a new member to a project with a role
• Update the role for a member of a project
• Delete a member from the project
• (Maybe) Search users by name or email

Suggested API

• GET /project/[project_id]/roles
  • Lists available roles for a project
  • Returns data in the format { id: string, display_name: string }[]
• GET /project/[project_id]/members
  • Lists members for a project
  • Returns data in the format { id: number, email: string, name?: string, image?: string, role: { id: string, display_name: string }[]
  • Requires caller to be a member of the project
• POST /project/[project_id]/members
  • Adds a new member to a project with a role
  • Expects a request body in the format { user_id: number, role_id: string }
  • Requires caller to be a project manager
• PUT /project/[project_id]/members/[user_id]
  • Expects a request body in the format { role_id: string }
  • Requires caller to be a project manager
• DELETE /project/[project_id]/members/[user_id]
  • Expects no request body
  • Requires caller to be a project manager
• GET /users?q=[search_term]
  • Search users by name or email
  • Returns data in the format { id: number, email: string, name?: string, image?: string }[]

[f-PLT]

API changes implementation will be done by @mohamedelabbas1996

[mihow]

For search endpoint, it seems okay to allow exact match searches as long as the user is logged in & has a project manager role.

We may add another search endpoint that allows auto-complete of names for only users that are members of the project. To be used for "@" mentioning identifiers in comments or assigning reviewers.