Draft: Define KB security rules

### Overview
Define roles and security rules so that a user can be assigned appropriate privileges

### Action Items
- [ ] Get approval from Bonnie

### Overview

Define privileges for KB roles for user and groups so that KB users have privileges needed and no unneeded priviliges and no information they don't. Implementation will be a separate issue.

### Action Items
- [ ] Review Detail Section
- [ ] Decide on which user fields are needed by KB users that will be displayed on the documents.

### Details Draft
There will be an API kb/user. The API will enforce user security based on PD roles that start with kb. The roles will be seeded into the existing Django roles table.

Terminology: A contributor is a People Depot user with the kb-contributor role. The API will be secured using Django roles. Below are the Django roles and what a

name
linked in
website
**Row Level Privileges**
- kb-nonpriv: user that can be associated with a document but has no privileges
- no privilege
- kb-viewer: user that can view all information but has no privileges
- PD: can view up to date level 1 fields of a PD user and roles
- can view all KB info
- kb-contributor
- PD: can view up to date level 1 fields of a PD user and roles
- can view all KB info
- can create a document
- can assign themselves to a document
- can update documents to which they are assigned
- kb-docadmin
- PD: can view up to date level 1 fields of a PD user and roles for users with a kb role
- can view all KB info
- can create, read, and update all documents
- can assign and deassign any contributor to a document. Some contributors may be Hack4LA users.
- can update all documents
- kb-admin
- PD: can view up to date level 1 fields of a PD user and roles for users with a kb role
- can view all KB info
- can create, read, and update all documents
- can assign and deassign any contributor to a document. Some contributors may be Hack4LA users.
- can create, read, and update all kb info (e.g.: topic area) that is not sourced from PD (e.g., users, roles, practice areas, and topic areas)
Below this is specified in table format.
Role | Users | Assign Yourself | View All KB Info | Self Assign | Update assigned document | Update all documents and assignments |
| ----- | ----- | ----- | ----- | ----- | ----- | ----- |
| kb-viewer | X | | | |
| kb-contributor | | | | |
| kb-docadmin | X | X | ||
| kb-poweuser | X | X | X |||
| kb-admin | X | X | X | X | X | X | X |

**Field Level Privleges**

- Read: Field level read privileges are the same for all users.
- Update: kb-admin and kb-useradmin can update any non-system fields that can be read except system populated fields.
- Create: kb-admin can specify any non-system field they can read

まず、この issue のロール別およびフィールドレベルの権限リストを確認します。ドラフトの表と、提案されている kb/user API の動作も含まれます。用語、ロール名の不一致、不足している権限エントリ、必要なユーザーフィールドを整理して解決し、その後 Bonnie の承認を得てください。実装は明確に別の issue です。

索引モデルが issue の本文から書いたものです。