Requirements for tasks files as 'Operations Access Request' (OAR):
- should get the Operations-Access-Request project associated.
- Tasks files as 'Operations Access Request' (OAR) should get the Operations project associated.
- Tasks should be public/all users for permissions (currently this is "admin" and members of operations-access-requests project which is not a "membership" oriented grouping)
- Tasks should create a subtask that is hidden and set to Operations only (currently this is set to allow ops and the original tasks author which defeats the point of the private subtask). Projects of this sub-task should be Ops-Access-Reviews & SRE
We discussed this in our Phabricator discussions this week, but I cannot find a task to track this particular item.
Any tasks created or moved into ops-access-requests should have a blocking subtask in ops-access-review. The idea of this is the request will have the user info and manager approval, where the review will be a private security review ticket.
Right now, we're manually creating these tickets, but it stinks. Automatically creating these tickets would be ideal. The creator/author is immaterial, but it should NOT include the original requestor of access from the ops-access-request task. It should only be for ops, so having it wholly unassigned and authored by an admin or system user for the blocking task would be ideal.
The suggestion in the meeting was to make an 'access request' option in the security drop down, which would do these ticket creations automatically.
Additionally, any task in ops-access-requests or ops-access-review should also get tagged with SRE.
As such, I've assigned this to Mukunda, since he handles that drop down implementation. If this is incorrect, please let me know!