User Group Isolation for Shared Ecosystem Access

[memmi-konior]

Story

As an ecosystem administrator, I want to group ecosystem users into user groups aligned with their owning team/product, so that tests and artifacts (runs, submissions, results) are scoped/accessible only to the specific user group that created them, and teams can't see or act on each other's tests.

Background

It is desirable to have multiple mainframe teams to share a single Galasa ecosystem. However, any user can view and act on tests submitted by any other user, regardless of their company department. The current Galasa model seems to assume everything is globally shared, which is not suitable for a company with multiple work teams.

We want team-level isolation made available, without standing up separate ecosystems per team.

Any test submitted by a user should automatically be associated with that user's group, so ownership is tracked at the team level. They are not allowed to submit or delete tests that do not belong to their user group.

Tasks

• Define the user group model (User group to be assigned during new user-creation, built in as part of the user's setting, user group's name to be unique etc.).
• Existing ecosystem users default to a 'nil' group, retaining current behaviour and avoiding disruption; admins organise user group assignment at their own pace. They may also choose to leave it as nil if this feature is not applicable to their use case.
• Automatically associate submitted tests with the requester (test submitter) and their user group at creation time.
• If possible, existing tests records submitted before groups existed to automatically be associated with its requestor's user group (if available). Otherwise, can be left as is as those test records should phase out eventually as time went by.
• Enforce group-scoped authorization on test actions (submit, view, create, delete, rerun, etc.), deny cross-group actions.
• Update any relevant docs/UI to surface group ownership on tests. For example, admin should be able to view this and possible assign group in the WebUI: