Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Limit member visibility for non-admins #4318

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
matifali opened this issue Oct 3, 2022 · 9 comments
Closed

Limit member visibility for non-admins #4318

matifali opened this issue Oct 3, 2022 · 9 comments
Labels
enterprise Enterprise-license / premium functionality
Milestone

Comments

@matifali
Copy link
Member

matifali commented Oct 3, 2022

For now, a non-admin user can see a full list of all coder users, their roles, emails, and last used time.

@bpmct
Copy link
Member

bpmct commented Oct 3, 2022

I definitely see the merit of this feature. When we run workshops or have demo environments we may not want all emails to be public!

We are adding groups support in #4235 including a global "Everyone" group. Perhaps each group (including "Everyone") could have a Member visibility: (true)/false setting.

Alternatively, we could restrict the page and API routes for admins only. As a user, I will want to know what groups I'm in, but not necessarily who the other users are in the group/deployment.

@ammario ammario added feature enterprise Enterprise-license / premium functionality labels Oct 3, 2022
@kylecarbs kylecarbs changed the title non admin users should not be able to view full list of users. Limit member visibility for non-admins Oct 3, 2022
@bpmct
Copy link
Member

bpmct commented Oct 3, 2022

@ammario suggested doing this via an env variable to disable viewing users for all non-admins. I agree.

@sharkymark
Copy link
Contributor

If a user wants to see their groups, that should be in their profile. Re-using an Admin tab like Users is not an enterprise good look IMO even if it's read-only.

@matifali
Copy link
Member Author

If a user wants to see their groups, that should be in their profile. Re-using an Admin tab like Users is not an enterprise good look IMO even if it's read-only.

Maybe a user should be able to view his own groups and the other members in the same groups at maiximum.

@matifali
Copy link
Member Author

Any plans for these guys?
I think it is required after we allow the opening coder to the public using GitHub signup.

No one should be able to view all the other members except the user admin or owner.
@bpmct

@ammario
Copy link
Member

ammario commented Nov 27, 2022

I think it's a fine default that regular users can't see everyone. I don't think we should add an additional configuration knob yet.

@matifali
Copy link
Member Author

But the regular users withy a member role can see everyone on the latest version.

@mtojek
Copy link
Member

mtojek commented Nov 28, 2022

Hey @bpmct! I found at least 2 similar request issues referring to the same problem:
#4550
#5002

Do you think that we can unify/deduplicate all these?

BTW I commented on the design here. It would be great to clarify it, and I don't mind where the response lands :)

@bpmct
Copy link
Member

bpmct commented Nov 30, 2022

Yep. Closing in favor of #5002

@bpmct bpmct closed this as not planned Won't fix, can't repro, duplicate, stale Nov 30, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enterprise Enterprise-license / premium functionality
Projects
None yet
Development

No branches or pull requests

5 participants