I don't know exactly how to file this. Koha is growing all the time and new features are always being added, but they are often being added with very little permission granularity. Often the permissions are too broad. For example, the newer pages under additional-contents.pl is under the entire umbrella of one permission for the user, and gives them access to ALL pages, ALL news, and ALL HTML customizations. I am hoping that Koha will start thinking more about roles in the library, and allowing us to give specific people access to specific pages, customizations, etc. This goes even further with who can override things. We don't have a lot of control over who can do what specific things. Maybe there is a bug on this topic already?
We are certainly due a permission clean-up and I there are a lot of bugs when you look for 'permission' that we could put here to make this an omnibus bug. One thing we might want to think about is moving away from the mix of borrowers.flags and the permissions table to give us a better base to order and group permissions. As a topic for discussion, it might be better suited for the mailing list or developer meetings.
I think that is a great idea. Also, I think maybe the best approach to something of this nature is creating a foundation framework for this that new features can use and existing features can hook onto as they are improved. I don't want people to look at this as a major overhaul to existing permissions. This should be something we can create the structure for and then move things over to as we move forward. Otherwise, I fear that developers are going to look at this as a daunting task, and too big to take on, especially as more and more features are continually developed and added on to Koha.
(In reply to Christopher Brannon from comment #0) > I am hoping that Koha will start thinking more about roles in the library, > and allowing us to give specific people access to specific pages, > customizations, etc. This goes even further with who can override things. > We don't have a lot of control over who can do what specific things. I think that you make a very good point, but Koha developers are a fairly loose group which support a variety of different libraries, and I think most developers have never worked as librarians themselves (with the exception of a few of us). Change usually comes from starting with one developer/vendor and then building support across the group. Personally, most of my (many) libraries have very small staff sizes, and I haven't heard any complaints around permissions (except for the latest one about requiring "edit_borrowers" to search/list borrowers). So I'm unlikely to get sponsorship for such a change. But I imagine there are other vendors who support libraries with larger staffs who would be more likely to get that kind of sponsorship. In the meantime, something that could be helpful is libraries coming up with a list of "personas" and "scenarios". These are useful elements of system design. Something basic like "Joe is a collection development librarian" (persona). The collection development librarian "needs to search the catalogue" (scenario), "needs to update only certain allowed lists" (scenario), "needs to update only collection development HTML pages" (scenario). Basically just outlining the hypothetical people and the things they need to do. From there the developers can start working out how we can technologically allow those people to do those scenarios.