Hey @jayswain, @hmehra and @imand3r can you guys give this a review please. 🙏🏻

Note that the public_user_access permission needs to be removed entirely in a follow up MR.

Diane Russel (6e8989c9) at 18 Mar 20:39

... and 89 more commits

We moved these permissions to the guest.yml role definition file but this whole condition isn't needed anymore because the admin_issue is only enabled for users who are members. This was probably a remnant of when admins returned false for the guest condition and needed to have permissions granted to them explicitly.

Diane Russel (67401817) at 18 Mar 20:00

Diane Russel (e983ea3e) at 18 Mar 19:41

Diane Russel (4aacd812) at 18 Mar 19:39

What does this MR do and why?

This MR adds the base public project permissions in YAML role files to match the pattern used by all other roles and fixes the logic so that public access doesn't enable guest access anymore.

• public_anonymous: read-only permissions for all visitors including anonymous users
• public_authenticated: write permissions for authenticated non-members, inherits from public_anonymous

References

#583543

Screenshots or screen recordings

Before	After

How to set up and validate locally

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Diane Russel (da710092) at 18 Mar 18:53

... and 3 more commits

Diane Russel (354e275b) at 18 Mar 18:29

... and 1 more commit

Diane Russel (93bc0076) at 18 Mar 18:29

What does this MR do and why?

Extract auditor permissions to a role definition file.

References

Screenshots or screen recordings

Before	After

How to set up and validate locally

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Looks good @imand3r although you have some merge conflicts

What does this MR do and why?

Refactor custom dashboard policy to use granular permissions

Replace reporter_access and developer_access checks in DashboardPolicy with delegated namespace conditions and specific permissions. Add custom dashboard permissions to reporter and developer role definitions. Update permission validation to support underscore-prefixed permission names.

References

Screenshots or screen recordings

Before	After

How to set up and validate locally

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #593274

Diane Russel (515f5647) at 18 Mar 16:45

Diane Russel (5835dfe8) at 18 Mar 16:45

... and 1 more commit