Only security team members can manage suggestions #324

New issue

Closed

opened 2024-11-01 18:18:52 +00:00 by fricklerhandwerk · 0 comments

fricklerhandwerk commented

2024-11-01 18:18:52 +00:00

(Migrated from github.com)

As a security team member I want to be sure that only I and other team members can

dismiss suggestions, or
create drafts.

Rationale:

If something is dismissed, we don't ever want to look back, so it must be an authoritative decision by the security team
- Ideally anyone could propose to dismiss, and maintainers would have to confirm, but that is a new workflow we'd have to build first.
Selecting should be slightly easier, and can already be used as a tool for maintainers to reduce the noise for the security team
- We only have to guard draft creation/publishing

Implementation hint: We already have bits and pieces of a permission system, which needs to be applied to the suggestion data model.

As a security team member I want to be sure that only I and other team members can - dismiss suggestions, or - create drafts. Rationale: - If something is dismissed, we don't ever want to look back, so it must be an authoritative decision by the security team - Ideally anyone could propose to dismiss, and maintainers would have to confirm, but that is a new workflow we'd have to build first. - Selecting should be slightly easier, and can already be used as a tool for maintainers to reduce the noise for the security team - We only have to guard draft creation/publishing Implementation hint: We already have bits and pieces of a permission system, which needs to be applied to the suggestion data model.