How should we manage ARIA-AT App roles?

[s3ththompson]

Currently, ARIA-AT App manages user logins with GitHub Oauth and user roles by checking membership of specific GitHub teams under the w3c org. Testers, admins, and developers must be added to the appropriate w3c team for the app to grant them the correct permissions. Unfortunately, due to how GitHub teams work, team members must first be added to the team's parent org.

When we last onboarded users for the pilot test, these teams (and the ARIA-AT App repo) were still under the bocoup org and the process for adding users was (relatively) lightweight. Now that the repo and teams live under the w3c org, we need to contact the appropriate person at the w3c to manually add new users to the w3c GitHub org before we can add them to the correct team. This is unnecessary overhead and potentially a misuse of w3c org membership.

More broadly, it would be great to revisit our working mode criteria for testers. Is there any way to reduce the number of obstacles for contributing test results?

Here are a few different options:

• We create an ARIA-AT GitHub org, just for the purpose of managing user roles via team membership
• We move user roles to an alternative (perhaps file-based) allowlist. This file could live in the repo, on the wiki, or somewhere else.
• We keep roles under W3C org teams, but only for admins. We allow any motivated tester to log into the app (with a softer requirement to seek help from the community group before contributing results.)

This issue was uncovered while working on #421 with @AlyssaGourley.

[alflennik]

We keep roles under W3C org teams, but only for admins

That's a nice solution! After all, admins still will get a chance to review any content testers create, so little damage can be done. I'll be curious to hear what others think today.

[s3ththompson]

Per our conversation in the last meeting, we will keep Admins managed under w3c teams, but implement an alternative allowlist for Testers.

To begin, this could be a list that is maintained as part of the w3c/aria-at repo (either a wiki page or a checked-in allowlist). In the long run, we should consider an in-app approval mechanism which would greatly improve UX and make it easier for Testers to request the right permissions. See tracking issue on the ARIA-AT App repo here: w3c/aria-at-app#300

[mcking65]

@s3ththompson
Can we remove the agenda labels now? or, do we need more discussion?

[s3ththompson]

@mcking65 oops, I meant to do that and somehow missed them. Done.

[s3ththompson]

Closed by w3c/aria-at-app#304, to be documented in #420.