Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Metadata form Userguide #1596

Merged
merged 17 commits into from
Oct 18, 2024

Conversation

SofiaSazonova
Copy link
Contributor

@SofiaSazonova SofiaSazonova commented Sep 30, 2024

Feature or Bugfix

  • Feature

Detail

  • This PR includes the documentation in the userguide for the metadata forms feature

Relates

Security

Please answer the questions below briefly where applicable, or write N/A. Based on
OWASP 10.

  • Does this PR introduce or modify any input fields or queries - this includes
    fetching data from storage outside the application (e.g. a database, an S3 bucket)?
    • Is the input sanitized?
    • What precautions are you taking before deserializing the data you consume?
    • Is injection prevented by parametrizing queries?
    • Have you ensured no eval or similar functions are used?
  • Does this PR introduce any functionality or component that requires authorization?
    • How have you ensured it respects the existing AuthN/AuthZ mechanisms?
    • Are you logging failed auth attempts?
  • Are you using or adding any cryptographic features?
    • Do you use a standard proven implementations?
    • Are the used keys controlled by the customer? Where are they stored?
  • Are you introducing any new policies/roles/users?
    • Have you used the least-privilege principle? How?

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the names for mf_create and mf_list are wrongly defined. mf_create should be mf_list and viceversa.

Copy link
Contributor

@dlpzx dlpzx left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I left some comments but basically they can be summarize as:

  1. as a new user I do not understand the permission model on metadata forms. What does "required" access mean, who can use the forms, who can edit the forms, what do I see in the list Metadata forms
  2. as a new user, I am not sure about the implications of each visibility type, and which entities can have metadata forms attached
  3. I am also missing some info about the lifecycle: what happens when a metadata form is edited, can we delete them if there are entities with attachments, also not clear that a metadata form can be dettached (I had to go until the end of the end)

2. Once form is created, the owners can add enforcement rules (see the section below).
3. All changes in metadata form can be performed only by its owner.
4. Metadata form can be attached to an entity by the user with sufficient permissions. Permissions are given by the owner or admin of the entity.
5. Attached metadata forms can be edited or deleted by any user with sufficient permissions.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What happens then when the metadata form is edited or deleted and it is attached to entities?

Sofia Sazonova added 2 commits October 3, 2024 14:02

**Introduction**

Metadata forms allow users to add structured contextual information to various entities in the data.all platform. By creating and attaching metadata forms, user can standardize and enrich metadata in a customizable way.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ultra nit: user -> users

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

or a data.all user

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This happens a couple of times in the file, we use "user" without any article (a/an/the) which I think might be a small grammar error


- Global visibility means the metadata form is visible and attachable to any entity by all users across the platform
- Organization/Environment-Wide visibility limits the form to a specific organization/environment - it can only be seen by members of this organization/environment and attached to entities in that organization/environment
- Team-Only visibility restricts the form to just members of a specific team, but does not restrict to which entities it can be attached to
Copy link
Contributor

@dlpzx dlpzx Oct 7, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could a team-only visibility form be attached to datasets in different environments if the team is the same?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe we should clarify that, to avoid questions

The same visibility restrictions apply to the attached metadata form. E.g. is userA can see Metadata Form A, but can't see Metadata Forms B, and both of these
metadata forms attached to the dataset (attachedA and attachedB), so userA can view attachedA, but can not view attachedB.

**Metadata Form lifecycle and usage**
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We are mixing lifecycle and permissions. lifecycle is just: create, add enforcement rules (optional or mandatory?), attach and then a comment on delete and edit

permissions: the whole point 1. then enforcement rules/edit/delete = only form owners, attach=depends on visibility right?


So in summary, enforcement capabilities cascade along with administrative privileges in the hierarchy. Global admins have full control, org/env admins can enforce for their sphere and below, dataset admins for the datasets and items in it, and share requesters and approvers for a specific share.

**View Metadata Forms**
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shouldn't this be part of the visibility paragraph? Maybe here you can reference that section above

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's not about visibility. It's particularly enforcement.

Copy link
Contributor

@dlpzx dlpzx left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

small changes only

Sofia Sazonova added 2 commits October 10, 2024 15:15
Copy link
Contributor

@dlpzx dlpzx left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Some typos and questions

Copy link
Contributor

@dlpzx dlpzx left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ready!

@SofiaSazonova SofiaSazonova merged commit 1813022 into data-dot-all:main Oct 18, 2024
9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants