CKAN: Ticket Query

#61: When dumping data to json do not dump private information like API keys

rgrp — Tue, 07 Apr 2009 16:58:49 GMT

Cost: 1h

#62: Change tags to contain any character (other than space)

rgrp — Fri, 24 Apr 2009 14:58:15 GMT

Requires us to url encode the tag names when displaying them ...

#67: List all of a user's recent edits on their home page

rgrp — Wed, 17 Jun 2009 18:35:31 GMT

Additional feature related to ticket:66.

cost: 2h

#71: Upgrade to Pylons 0.9.7

rgrp — Wed, 01 Jul 2009 07:57:21 GMT

Cost: 2h

#74: Add Is It Open links to package pages

rgrp — Fri, 17 Jul 2009 10:56:58 GMT

On each package page in the openness field if the package is not open provide a link to is it open create enquiry page.

Details:

may want to add to the url a query parameter indicating which package this relates to e.g. ?ckan-package=...
http://isitopen.ckan.net/enquiry/create/?ckan-package=...
do we provide link even if package is open (e.g. so that people can make enquiries about e.g. adding open data/content buttons ...)

Cost: 0.5h

#79: Improvements to package search

rgrp — Fri, 17 Jul 2009 11:24:24 GMT

Several things:

Default package search (used e.g. on front page) should deal well with multiple items: "abc xyz" means search for both abc and xyz (as separate searches)
Should automatically display a list of matching tags in a line at top with number of associated packages
have an option to only search for fully open material (or openly licensed material ...)

Since we should be moving to a more sophisticated search solution anyway (to allow prioritisation etc) maybe we should cautious as to what we do now.

#80: Refactor or remove modes code

rgrp — Fri, 17 Jul 2009 15:24:23 GMT

Get rid of modes in the RESTful API. Do json stuff directly in controllers.

package will have to_dict and from_dict methods (called by rest controller) which provide and consume JSON friendly dictionaries representing the object. from_dict - class_method. stuff in forms for tags as_string, maybe factor out. reuse validation stuff.

#127: Minor form and UI improvements

dread — Thu, 24 Sep 2009 13:24:19 GMT

group form: description field for needs to be a text area
group form: make title and name field wider
package view: need to move tags and license above notes

#66: Improve user account UI

rgrp — Wed, 17 Jun 2009 18:34:45 GMT

Link at top should say "Your Account" when you are logged in
- when not logged in should say: "Log in via openid"
- Open Id info on /account/ should move to /account/login/ or be deleted
- Going to /account/ when not logged in should redirect to /account/login/

When logged in the basic account index page should not give generic information but should reflect fact you are logged in by:

Saying something like: "You are logged in as: ..."
Showing your apikey or a link to apikey
Giving you a logout link

We can think of a bunch of other stuff that could go on their (recent edits, packages you own etc) but these will be separate tickets.

#72: Integrate new logo

rgrp — Wed, 01 Jul 2009 09:37:01 GMT

Integrate new logo from http://wiki.okfn.org/ckan/logo into site:

In title

Also can do favicon (separate ticket:48)

Cost: 1h

#114: Access Control - model

dread — Wed, 09 Sep 2009 11:08:47 GMT

Create in the model basic operation of Access Control.

roles table

name | context | action
-----------------------
admin| package | edit
admin| package | edit-permissions
admin| package | read
editor| package | update
editor| package | read
reader| package | read
This data is set-up on db init and will have no interface.

user-roles table:

username | context_type | objectid | role
rgrp     | system  | n/a | admin
visitor  | package | * | reader
bob      | package | geonames | admin
visitor  | package | geonames | editor
visitor  | package | geonames | reader
john     | group | ukgov | admin
dread    | group | ukgov | editor
visitor  | group | ukgov | reader
This data will be added when someone is given permissions for the system, a package or a group.

Pseudo code:

class Package

def is_allowed(name, action):

is_allowed(name, action, context=self)

class Group

def is_allowed(name, action):

is_allowed(name, action, context=self)

def is_allowed(name, action, context=None): name: string - a username or IP for 'visitor'

action: string - 'read', 'edit', 'delete', 'edit-permissions' context: object - a Group or a Package or None (which means system)

# look up user from name. # look up in user-roles table what roles this user has for this context. # for each roles, look up in roles table what actions are allowed. # return True if action is allowed, else False.

#115: Access Control - wui constrained by model

dread — Tue, 15 Sep 2009 17:06:34 GMT

Based on a section of AccessControl design: Reading and writing to packages in the WUI and REST API are now dependent on the authz tables.

#117: Access Control - group core functionality

dread — Fri, 18 Sep 2009 10:55:33 GMT

Based on a section of AccessControl design: Group reads and edits are controlled by access control. WUI and REST interfaces covered.

#118: Use paginate in webhelpers

dread — Fri, 18 Sep 2009 11:34:17 GMT

Take out import of paginate in setup.py. Use paginate in webhelpers instead. Make changes to take account of any i/f changes.

#119: Ensure non-active packages don't show up

dread — Mon, 21 Sep 2009 10:36:54 GMT

Ensure pending packages don't show up in search or browse

cost: 4h

#120: Security audit

dread — Mon, 21 Sep 2009 10:37:07 GMT

Look for all places where model is accessed and check authorization is checked.

Document holes (and, as necessary, suggestions for fixes) as new tickets. Likely areas that need looking at:

search i/f
package WUI commit
Write holes are obviously much more significant to us than read holes.

#121: Add 'Group' to main menu

dread — Wed, 23 Sep 2009 08:33:47 GMT

And associated page to browse group.

#122: Add Group authz page

dread — Wed, 23 Sep 2009 08:34:02 GMT

#123: Ability to edit Group in WUI

dread — Wed, 23 Sep 2009 12:14:01 GMT

Add Group editing page.

If no permissions to change group can't edit group. Also cannot view edit page.

Editable attributes: name, title, description

No preview needed

#131: Groups REST interface

dread — Wed, 30 Sep 2009 10:52:39 GMT

Controlling Groups through a REST interface.

#43: Generic Attributes for Packages

rgrp — Tue, 08 Jan 2008 10:28:29 GMT

As A

User

I Want To

Add arbitrary named attributes to packages (an attribute being a name, type, value triple).

Details

We will do this using a dedicated (versioned) table associated to Package
Do we allow multiple attributes of the same name?
For the present: No (since we will key by attribute name)
Could allow for single attribute but with multiple values using json list ...
What types do we allow or do we just rely on JSON to take care of this?
Questions (Original)

How complex is this to implement?
What would an arbitrary user be able to edit? Possibilities:
'create new attribute' and setting the value (so name and type would be chosen from predefined list).
'create', setting of name and value (but not type -- type already set in predefined list)
Could just use (machine) tags -- though this could be seen as a bit of a hack.
Would solve having to create special file/url attributes (though I think that perhaps file stuff is important enough to merit first class support in the domain model -- though, that said, since one won't want to have a file limit adding unlimited file support is very similar to unlimited attributes of arbitrary type).

#64: Switch to repoze.who for authentication

rgrp — Tue, 16 Jun 2009 16:14:13 GMT

Switch to repoze.who + openid plugin for authentication from authkit.

Already did this in microfacts so should be fairly easy.

#76: Convert to use formalchemy for all forms

rgrp — Fri, 17 Jul 2009 11:10:41 GMT

Current form stuff is not very good (uses formencode). Switch to formalchemy would improve this, especially on validation.

As an extra we could utilize the formalchemy pylons admin interface (pretty much for free).

Cost: 12h

Details

Replace htmlfill and formencode extract in controllers/templates with formalchemy
Crude and simple
Suppress unwanted fields (revision, state, all revisions) and sort out ordering to be similar to before.
Sort out tag field with a special renderer
Validation - testing definitely required.
Fix up description and pretty css etc

#91: Add author and maintainer attributes to package

rgrp — Fri, 31 Jul 2009 14:16:20 GMT

Add the following attributes to package:

author, author_email
maintainer, maintainer_email
Gives us full compatibility to: http://docs.python.org/distutils/setupscript.html#additional-meta-data

Column ordering - should come after name, title, url, download_url.

#93: Access control for packages

rgrp — Fri, 31 Jul 2009 15:44:09 GMT

Should be able to limit ability to a user's ability to do things with packages (read, edit etc). This is a big ticket (it may required splitting) and full details are in separate wiki page: AccessControl.

Cost: 8d

#94: Use sqlalchemy-migrate to handle db/model upgrades

rgrp — Sat, 01 Aug 2009 13:43:05 GMT

Details of how to go about this here <http://www.rufuspollock.org/2009/07/27/sqlalchemy-migrate-with-pylons/>

Cost: 2h

#105: Package groups (view)

rgrp — Thu, 27 Aug 2009 16:58:02 GMT

As a user I want to be able to create groups of packages.

This functionality is different from tags:

The ability to add a package to a given group is restricted whereas anyone can add a given tag to a package
Specifically groups have owners and only the owners can add a package to that group
Group properties

id (primarykey, uuid style)
name (restricted content - same rules as package)
title (no restrictions)
owners -- many:many with user object
description (markdown)
packages -- many:many with package object
Don't version groups for now.

Groups address in the WUI will be:

/group - browse list of groups (reuse list action)
/group/list - same thing for now
/group/<groupname> - display: group properties with links to packages. No links to user pages (yet).
Group editing and searching will be another ticket.

Cost: 3d

#108: Package search in the REST API

rgrp — Wed, 02 Sep 2009 18:24:05 GMT

Add package search facility in the rest api at /api/search

Queries can be provided as for the normal package search either by posting to that url or by performing a get with a query string.

E.g. .../api/search/package?q=xyz

Query parameters:

q is keyword string (searches name, title, tags by default)
split by words and ANDed
additional parameters for specific fields
qjson is alternative to q for Searching by specific fields (in addition to keyword string). Payload to json is a JSON-encoded dict which is a dictionary with a q field for free text (keywords) and additional key/value pairs for specific fields
if q and qjson specified ignore q and just process qjson value
Additional parameters in addition to query ("q" or "qjson") are:

limit
offset
fullinfo=0/1 - return full record for each result (default=0)
order_by=field_name
search_notes=0/1 (default 0) do we search notes field in a keyword search
Return value is json encoded dictionary with keys:

'results': list of results
'count': total number of results
Extras (for the future)

Prioritisation is not part of this ticket (requires fulltext support in DB or in external app such as Xapian)

#110: Integrate groups into packages

dread — Mon, 07 Sep 2009 09:32:36 GMT

Package needs a groups property (backref Group.packages).
Put groups in the search api.
Display them on the package, but not editable. (Only editable from the group page.)
Follow up to ticket:105 (Groups).

Cost: 1d

#116: Access Control - edited in wui

dread — Tue, 15 Sep 2009 17:13:22 GMT

Based on a section of AccessControl design: WUI gives controls to user and administrator to change permissions on a package.

#126: Change package state in the WUI (delete and undelete)

dread — Thu, 24 Sep 2009 10:52:51 GMT

As a Package Admin I want to change the state of the package. In particular I wish to delete and undelete it.

(NB: this is quite separate from "purging" objects which is the term we shall use for irrevocable removal of an object from the domain model).

Only Package Admins (and sysadmins) should be able to change state
Implementation Suggestions

'delete' action should be renamed to 'change-state' (NB: this requires a db migration ...)
Have new package formalchemy form (created via inheritance?) to incorporate state attribute. Suggest this is rendered as a dropdown (and may be simple object rendering of state, i.e. do NOT need to change it to a single name such 'active').
This form should then be used when the user satisfies is_authorized(..., model.Action.CHANGE_STATE) instead of the usual fieldset

#130: Create a New Group via the WUI

rgrp — Mon, 28 Sep 2009 09:30:12 GMT

As a

User

I want to

Create a new group via the WUI

Details

locate at /group/new/
You must be logged in to create a group
Group creator is automatically given role of group admin
Edit screen is same as edit screen ...

#111: Create user object

dread — Mon, 07 Sep 2009 09:33:14 GMT

Object properties:

id (uuid)
apikey (uuid) -- migrated from the apikey table
name (username = openid)
/account is being renamed to /user in the wui.