[Feature] Multi-User

[ErisDS]

Description

Adding multi-user support for ghost so that teams of people can write a blog together. This involves administrators, editors and authors. Shazam.

---

Details:

The new owner role

The owner is a user which is one level above admin. An owner can do absolutely anything - no permissions apply to them, or rather canThis should default to true if the user has role owner.

There can only ever be one owner in a Ghost blog, and a user with role owner cannot be deleted.

An owner can choose to transfer ownership (that is the owner role) to any other admin user.

The owner role will be setup with a single user as a fixture. That user will be 'commandeered' or taken-over by the first signup (setup). In existing Ghost blogs, the single current admin user will be upgraded to an owner.

The new setup flow

Ghost blogs will be 'installed' or 'setup' from the new setup screen, the signup screen will no longer be used for creating the first user, but only for creating new users.

The setup screen includes the blog title as well as the user details.

The setup screen will hijack the new 'owner' role user which will be a fixture.

The invite flow

Users will be added to a Ghost blog by being invited. The invite screen is shown here: https://github.com/TryGhost/Ghost-UI/issues/21.

The new owner role can do anything it likes.
An admin can invite a user, and that user can have the admin, editor or author role.
An editor can invite a user, but that user can only have the author role.
An author cannot invite a user.

An invite creates a user with an empty name and password, but with an email address. The invited user has a status of 'invited'.

Once invited, a user is sent an email with a URL with a token, similar to a forgotten password URL. The URL takes them to the signup screen and allows them to enter their name and password, and pre-fills their email address (it can be changed).

The signup process then completes the details of the user, and changes the status to 'active'. The user is automatically logged in.

---

The Plan!

I don't normally write up a plan of what issues need to be done first, but in order to deliver MU very very fast, I thought it would help.

Getting Ghost MU-ready involves three main tasks: 1. making it possible to create and manage multiple users 2. making the admin safe for multiple users and 3. adding features to make Ghost work nicely with multiple users. The 3 individual tasks should be able to run concurrently, although it will be tricky to test the safety and features without having at least 2 users in the system, and that will be easier once the creation and management tools are in place, so that has to take slight priority.

To that end, I've grouped the issues above into 2 phases that can happen concurrently. I will ask that people pick up and deliver items from phase 1 first, followed by phase 2.

Phase 1 issues (For 8th July):

• Setup:
  • Setup Screen Wiring New setup screen and process for blog installation #3072
  • Owner role, fixtures and migration Owner role, fixtures and migration #3073, [Discussion] created_by/updated_by without a user #2399
  • First pass: new user management settings screen First pass: new user management settings screen #3078
  • Invite a user modal Invite a user modal #3079
  • User & Roles API: Invite a user User & Roles API: Invite a user #3080
  • User API: Accept an invite User API: Accept an invite #3081
  • Users API: deleting users Users API: deleting users #3100
• Security:
  • XSS prevention - Investigate XSS filtering  #1378 (probably needs a new issue)
  • CSP - Content Security Policy #332
• Features:
  • Shiny new user pages Shiny new user pages #3076
  • Helper updates for User Pages Helper updates for User Pages #3077

Phase 2 issues (For 15th July):

• Setup:
  • Change setup to hijack the owner user Change setup to hijack the owner user #3074
  • Invite Email & Signup screen UI changes Invite Email & Signup screen UI changes #3082
  • Users API: advanced browsing Users API: advanced browsing #3085
  • User management settings screen part 2 - [Ember.js] Settings: User Tab #2422 / TryGhost/Ghost-UI#21 (needs a new issue)
  • User edit/profile screen - [Ember.js] Settings: User Tab #2422 / TryGhost/Ghost-UI#33 (needs a new issue)
  • [Draft] Finish up the 003 data version Finish up the 003 data version #2600
• Security:
  • Race condition fix Race condition when creating initial user could allow multiple users to be created. #1834
  • Transfer ownership Transfer ownership #3087
• Permissions:
  • Owner permissions Owner permissions #3075
  • Additional permissions Additional permissions #2739
  • User API Permissions: Restrict based on role User API Permissions: Restrict based on role #3096
  • User & Roles API: Who can invite what role User & Roles API: Who can invite what role #3083
  • UI Cleanup: Who can see what? Multi-User admin UI: Who can see what. #3086
• Features:
  • Post Settings Menu: Author dropdown Post Settings Menu: Author dropdown #3084
  • User email address hide publicly Feature Request: User email address hide publicly #2330

[ErisDS]

Closing now that #3497 is done.