Access control brain dump

Currently:

• a Codelist belongs to a Project
• a Project belongs to one or more Organisations
• a User belongs to an Organisation (but should be allowed to belong to more than one)

In theory this allows access control based on organisation, and lets us have different versions of similar codelists in different projects (avoiding contested definitions).

Currently, there is no access control, and new users are added by global admins.

It would be good to have:

• creation of new users via web page
• email notification, with link to password form, when new user added
• a password reset buttong

but this is not urgent.

Once we have collaborators working on different projects, we should at a minimum:

• restrict adding/editing codelists to members of organisations that the codelists' project belongs to
• allow members of an organisation to invite new members to the organisation
• allow codelists to belong directly to a user

But we can leave creating organisations and projects to global admins.

Longer term, we may want:

• different classes of user
  • organisation admins can add members to the organisation
  • organisation admins can request to join projects
  • project admins can accept requests from projects
• per-codelist permissions
  • so only certain users can update a codelist

Authentication is orthogonal and I don't have any strong opinions. I have a slight preference for doing it all in Django -- it's not that hard, and I think gives a nicer user experience than using eg GitHub for SSO.

The issue names no files or tests and combines several access-control and authentication proposals. Start by reviewing the existing Django user, organisation, project, and codelist models and web entry points, then turn the requirements into a scoped decision. Done should mean an agreed, testable first phase rather than implementing the full list.