[V11] User Permissions Refactor

[surajshetty]

Dear all,

We recently did user permission changes and It’ll be pushed to staging fixes.
https://github.com/frappe/frappe/pull/6397/files

Basically, we tried to simplify the structure of user permissions by removing skip_for_doctype multi-check.

So now, there will be a separate user permission record for every applicable doctype (unless Apply to all Document Types is checked).

This will enable a contextual user permission system
i.e., User can define what docs(in link fields) should be allowed under a specific parent doctype.

This structure will be much more clear to understand and will also be import friendly.

Best,
Suraj

[Andrew_McLeod]

Does this change the way child table ‘permissions’ are handled?

[surajshetty]

@Andrew_McLeod there’s no change in the child table permission implementation.

[szufisher]

Proposal to refactor user permission based on SAP's authorization object concept

Hi, I’m tempted also to adopt the SAP model too but I think that in a doctype-centric system it might not be an intuitive design. My proposal: Today in ERPNext, the roles are controlled like in the screenshot below. [image] What if we added the ability to include constraints and custom activities as shown in the screenshot below? I think we would have effectively achieved everything that SAP’s authorization model achieves while still working in a familiar framework. [image] Roles could…

how about this new refactor proposal? or how the different use cases works in your design? any possibility we work together and come out a ultimate solution for all identified use cases?