@recaptime-dev's working patches + fork for Phorge, a community fork of Phabricator. (Upstream dev and stable branches are at upstream/main and upstream/stable respectively.)
hq.recaptime.dev/wiki/Phorge
phorge
phabricator
Fix many lies in the "User Roles" document
Summary: Fixes T3047. Update this document and remove some lies ("menu bar is read in admin interfaces"!!!!).
Test Plan:
- Read text.
- Searched for "System Agent" in the UI and replaced it with "bot" or "bot/script" or similar.
Reviewers: chad, btrahan
Reviewed By: btrahan
Subscribers: epriestley
Maniphest Tasks: T3047
Differential Revision: https://secure.phabricator.com/D8675
+53
-44
+2
-2
scripts/user/account_admin.php
+2
-2
scripts/user/account_admin.php
···
123
123
124
124
$is_system_agent = $user->getIsSystemAgent();
125
125
$set_system_agent = phutil_console_confirm(
126
-
'Should this user be a system agent?',
126
+
'Is this user a bot/script?',
127
127
$default_no = !$is_system_agent);
128
128
129
129
$verify_email = null;
···
163
163
164
164
printf(
165
165
$tpl,
166
-
'System Agent',
166
+
'Bot/Script',
167
167
$original->getIsSystemAgent() ? 'Y' : 'N',
168
168
$set_system_agent ? 'Y' : 'N');
169
169
+1
-1
src/applications/people/controller/PhabricatorPeopleListController.php
+1
-1
src/applications/people/controller/PhabricatorPeopleListController.php
+2
-2
src/applications/people/query/PhabricatorPeopleSearchEngine.php
+2
-2
src/applications/people/query/PhabricatorPeopleSearchEngine.php
···
108
108
->addCheckbox(
109
109
'isAdmin',
110
110
1,
111
-
pht('Show only Administrators.'),
111
+
pht('Show only administrators.'),
112
112
$is_admin)
113
113
->addCheckbox(
114
114
'isDisabled',
···
118
118
->addCheckbox(
119
119
'isSystemAgent',
120
120
1,
121
-
pht('Show only System Agents.'),
121
+
pht('Show only bots.'),
122
122
$is_system_agent)
123
123
->addCheckbox(
124
124
'needsApproval',
+1
-1
src/applications/typeahead/controller/PhabricatorTypeaheadCommonDatasourceController.php
+1
-1
src/applications/typeahead/controller/PhabricatorTypeaheadCommonDatasourceController.php
+1
-1
src/docs/tech/chatbot.diviner
+1
-1
src/docs/tech/chatbot.diviner
···
63
63
To allow the bot to access Conduit, you need to create a user that it can login
64
64
with. To do this, login to Phabricator as an administrator and go to
65
65
##People -> Create New Account##. Create a new account and flag them as a
66
-
"System Agent". Then in your configuration file, set these parameters:
66
+
"Bot/Script". Then in your configuration file, set these parameters:
67
67
68
68
- ##conduit.uri## The URI for your Phabricator install, like
69
69
##http://phabricator.example.com/##
+46
-37
src/docs/user/userguide/users.diviner
+46
-37
src/docs/user/userguide/users.diviner
···
1
1
@title User Guide: Account Roles
2
2
@group userguide
3
3
4
-
Describes account roles like "Administrator", "Disabled" and "System Agent".
4
+
Describes account roles like "Administrator", "Disabled" and "Bot".
5
5
6
6
= Overview =
7
7
8
8
When you create a user account, you can set roles like "Administrator",
9
-
"Disabled" or "System Agent". This document explains what these roles mean.
9
+
"Disabled" or "Bot". This document explains what these roles mean.
10
10
11
11
= Administrators =
12
12
13
-
**Administrators** are normal users with extra capabilities. They have access
14
-
to some tools and workflows that normal users don't, which they can use to
15
-
debug and configure Phabricator. For example, they have access to:
13
+
**Administrators** are normal users with a few extra capabilities. Their primary
14
+
role is to keep things running smoothly, and they are not all-powerful. In
15
+
Phabricator, administrators are more like //janitors//.
16
16
17
-
- **Account Management**: The primary function of administrators is adding,
18
-
disabling, and managing user accounts. Administrators can create and edit
19
-
accounts and view access logs.
20
-
- **Repositories**: Administrators can configure repositories. This isn't
21
-
normally available because it is specialized and complicated to configure.
22
-
23
-
Administrators have a few other minor capabilities in other tools. When you are
24
-
in an administrative interface, the menu bar is red.
17
+
Administrators can create, delete, enable, disable, and approve user accounts.
18
+
Various applications have a few other capabilities which are reserved for
19
+
administrators by default, but these can be changed to provide access to more
20
+
or fewer users.
25
21
26
22
Administrators are **not** in complete control of the system. Administrators
27
-
**can not** login as other users or act on behalf of other users. Administrators
28
-
**can not** bypass object privacy policies.
23
+
**can not** login as other users or act on behalf of other users. They can not
24
+
destroy data or make changes without leaving an audit trail. Administrators also
25
+
can not bypass object privacy policies.
26
+
27
+
Limiting the power of administrators means that administrators can't abuse
28
+
their power (they have very little power to abuse), a malicious administrator
29
+
can't do much damage, and an attacker who compromises an administrator account
30
+
is limited in what they can accomplish.
29
31
30
32
NOTE: Administrators currently //can// act on behalf of other users via Conduit.
31
33
This will be locked down at some point.
32
34
33
-
= System Agents =
35
+
= Bot/Script Accounts =
36
+
37
+
**Bot/Script** accounts are accounts for bots and scripts which need to
38
+
interface with the system, but are not regular users. Generally, when you write
39
+
scripts that use Conduit (like the IRC bot), you should create a Bot/Script
40
+
account for them.
41
+
42
+
These accounts were previously called "System Agents", but were renamed to make
43
+
things more clear.
34
44
35
-
**System Agents** are accounts for bots and scripts which need to interface
36
-
with the system but are not regular users. Generally, when you write scripts
37
-
that use Conduit (like the IRC bot), you should create a System Agent account
38
-
for them. System agents:
45
+
The **Bot/Script** role for an account can not be changed after the account is
46
+
created. This prevents administrators form changing a normal user into a bot,
47
+
retrieving their Conduit certificate, and then changing them back (which
48
+
would allow administrators to gain other users' credentials).
39
49
40
-
- **can not login** (they //can// access API methods via Conduit);
41
-
- **can not review diffs or own tasks**;
42
-
- **do not appear in CC tokenzers**.
50
+
**Bot/Script** accounts differ from normal accounts in that:
43
51
44
-
Currently, the **System Agent** role for an account can not be changed after the
45
-
account is created. This prevents administrators form changing a normal user
46
-
into a system agent, retrieving their Conduit certificate, and then changing
47
-
them back (which would allow administrators to gain other users' credentials).
52
+
- administrators can access them, edit settings, and retrieve credentials;
53
+
- they do not receive email;
54
+
- they appear with lower precedence in the UI when selecting users, with
55
+
a "Bot" note (because i t usually does not make sense to, for example,
56
+
assign a task to a bot).
48
57
49
58
= Disabled Users =
50
59
···
53
62
contract ends) you should disable their account to terminate their access to the
54
63
system. Disabled users:
55
64
56
-
- **can not login**;
57
-
- **can not access Conduit**;
58
-
- **do not receive email**;
59
-
- **do not appear in owner/reviewer/CC tokenizers**.
65
+
- can not login;
66
+
- can not access Conduit;
67
+
- do not receive email; and
68
+
- appear with lower precedence in the UI when selecting users, with a
69
+
"Disabled" note (because it usually does not make sense to, for example,
70
+
assign a task to a disabled user).
60
71
61
-
Users can only be disabled (not deleted) because there are a number of workflows
62
-
that don't make sense if their account is completely deleted, like: finding old
63
-
revisions or tasks that they were responsible for (so you can get someone else
64
-
to take care of them); identifying them as the author of their changes; and
65
-
restoring all their data if they rejoin the project (e.g., they are later
66
-
re-hired, maybe as a full time employee after an internship).
72
+
While users can also be deleted, it is strongly recommended that you disable
73
+
them instead if they interacted with any objects in the system. If you delete a
74
+
user entirely, you won't be able to find things they used to own or restore
75
+
their data later if they rejoin the project.