User rights

[tomlatter]

We need to agree on how we want to manage user rights throughout amrit products (dashboard/operator tools/api/mobile app).
We should try to make this as simple as possible.
I suggest something like this if this would be enough for the operator tools:
rights-mgmt.md

If possible I think we should seperate this from the 40+ list of roles attributed to individuals within a program that often serve only to acknowledge the contribution (which is important and must be kept, but not necesarily linked to metadata editing rights)

Roles vs Permissions

Five roles throughout the system, but diffrent rights depending on entities being viewed/edited.

For Programs:

Role	View	Create	Edit	Delete
Anonymous	❌	❌	❌	❌
Logged in	✅	❌	❌	❌
Program member	✅	❌	❌	❌
Program manager	✅	✅	✅	❌
Super user	✅	✅	✅	✅

For Ships:

Role	View public	View sensitive	Create	Edit	Delete
Anonymous	✅	❌	❌	❌	❌
Logged in	✅	✅	❌	❌	❌
Program member	✅	✅	✅	✅	❌
Program manager	✅	✅	✅	✅	❌
Super user	✅	✅	✅	✅	✅

• Ships do not need to be linked to a specific program, a member of any program can create/edit any ship

For Missions/Deployments/Passports/Stations:

Role	View public	View sensitive	Create	Edit	Delete
Anonymous	✅	❌	❌	❌	❌
Logged in	✅	✅	❌	❌	❌
Program member	✅	✅	✅	✅	❌
Program manager	✅	✅	✅	✅	❌
Super user	✅	✅	✅	✅	✅

• Semi-sensitive info requiring login includes Telecom IMEI number

For Program Assets:

Role	View	Create	Edit	Delete
Anonymous	❌	❌	❌	❌
Logged in	❌	❌	❌	❌
Program member	✅	✅	✅	✅
Program manager	✅	✅	✅	✅
Super user	✅	✅	✅	✅

For Alerts:

Role	View	Ack/Unack	Archive	Delete
Anonymous	✅	❌	❌	❌
Logged in	✅	❌	❌	❌
Program member	✅	✅	✅	❌
Program manager	✅	✅	✅	❌
Super user	✅	✅	✅	✅

Visibility states

• Public: visible to everyone (including Anonymous)
• Connected: visible to logged-in users
• Program: visible to logged-in users in the same program
• Private: visible only to the owner + group admins (and super users)

[tomlatter]

We can add a Program editor role if required between Program member and Program Manager