Feature Request/Idea: Added more granularity to roles permissions

[gwendoux]

Overview of the Feature Request
Currently the role permission has 13 items which includes rights to add/edit/remove/view dataverses and datasets, manage datasets or dataverses permissions or download files. These authorizations are sometimes too broad, giving too many rights to employees who have been authorize.

What kind of user is the feature intended for?
Admin, Superuser

What inspired the request?
This request is a follow-up to the following discussion on Dataverse Google Groups: https://groups.google.com/g/dataverse-community/c/4VM49qUqMGo/m/_HhjaJtwBAA

What existing behavior do you want changed?
Some installations need more granularity in defining role permissions in order to better define those roles. Some permissions include other rights that can be abused by other users or that can result in undesirable behavior.

Any brand new behavior do you want to add to Dataverse?
Added more specific rights and extend the number of role permission to allow more complex workflow and prevent abuse and/or side effects.

Any related open or closed issues to this feature request?

[pdurbin]

Related:

• Everything but publishing Role #9358
• Creating private URL not possible for the role "Contributor" #9938

[DS-INRAE]

There should be a discussion on what specific permissions need to be split or clarified.
In the meantime I created an issue for the case of managing private URLs being included in ManageDatasetPermissions

• Add a ManagePrivateURL permission #10574

[gwendoux]

This issue isn't quite fully baked yet. In our case, we have some specific issues with permissions.

1. The deaccession permission is "bundled" with ManageDatasetPermissions. For example, we have collection managers who manage datasets and dataverses within their collections, add contributors, etc. However, with this role, they can deaccession datasets, and sometimes this functionality has been abused by some.
2. Contributors don't have the ability to accept or deny access to their restricted files. In our case, we apply a specific custom role for a contributor group that includes every contributor of the same collection. This custom role has "ManageFilePermissions" as an attribute. But when a visitor requests access, all users in the contributor group receive the access request, not just the contributors to the specific dataset in question.

Maybe I should create two new issues for each of these specific cases.