GitLab Manage: Access Group, 29 Nov 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Customizable Roles Status and Catch Up 11/29/2022

Description

Hannah and Jessie from the Auth team catch up on the current state of customizable roles

A

B

A

B

A

Wanted to touch base on sort of the latest of where we are with customizable roles. I know you've made progress since we talked last time and I have promotional stuff. I have going on so just want to make sure we're aligned with timing and progress of everything.

B

Yeah so um and I have some questions for you too, that I wrote down, so the status is that the code, as you saw in the demo, video that I did the code for custom roles, is on getlab.com. It went out with the last release. So if the feature flag is on for a group, um the customizable roles feature flag. They can create a custom role via the API that enables uh guest a special kind of guest user. Basically, that can download code. That's the only thing. That's customizable role can do right. Just.

A

A one how's that feature flag on: how would they do it, because I thought you mentioned that you had to talk to some internal people exactly.

B

Yeah, so that's the other piece, so they they can do it assuming um the piece that they can do themselves via the API is create the role so there's an API endpoint to create a custom role, um that's associated with a root group that has this- and this is all documented in a merge request. So I can just screen share really quickly. It's a draft um you just this draft, so merge request.

B

B

um Is that you're, using that yep cool- uh and this shows the process currently, which is that you enable the feature flag you?

B

um This only applies for private projects because for a public project a guest could already download code. So so there's a private project. um You can make a request to the API endpoint. This is just on staging and then uh you can. This is the piece this bullet point right here that is still manual, which is that in a rails console you have to go in, find a regular guest and like make them a special guest.

B

So we have, as part of the 15 7 release a an issue that is marked as deliverable to create an API endpoint. To do this piece, that's currently manual, uh uh and so then after that is complete, then a user should be able to to use one of these roles on gitlab.com.

A

So does this update the existing guest role to be the custom role or do you have to then take the new custom role and assign it to a user.

B

um So the way that I did it is that, oh, so uh let me think if I understand your question so you're asking, does this take an existing guest and change it or is it like a brand new thing? A brand new member is.

A

It a yeah so if somebody is already in uh or somebody's already assigned the role of guests and I do this manual step, um though they then automatically turn into guest plus one or or do I have to then assign them this new role they.

B

It should be automatic, so I in the issue. Let me pull up the issue um off of our board, because I think I suggested two different ways and um whoa: okay did I, do the wrong one. What have I done here I did the wrong thing. This one I clicked on 15 7, instead of forward. So the issue is all the way at the bottom here here.

B

So I I proposed two options: um I think in either case you're going to be providing a group and a user, and basically you're saying make this user a custom role on this group.

A

Okay, where am I concerned I, don't think I have a quiz.

B

A

Sure we cover is um that we don't want any of this to happen.

A

um We want this to be something that people can opt into, because there are some customers that are concerned about giving their guests more privilege and.

B

A

Keep guests the way it is so what we want to do is just make sure that whenever this is customer facing that we it's something that you would have to specifically go in and assign or do, um and it wouldn't be something that would just happen by default. Yeah.

B

Yeah, absolutely so that's yeah, it won't happen by default. It will be a new type of role that you can associate with a user, but no there's not going to be any kind of data migration where existing guests automatically become these special guests, because the way that all this is implemented, even though there's only like one thing, you can do right now, so all these custom roles are gonna. Look the same.

B

um The actual custom roll is like a different thing for each group, like each group that creates this custom role will have their own special custom role. That's just like looks identical to all the other ones, because right now it doesn't do very much um so we're not going to create anything for them, they're going to have to create their own custom roles and Associate them with users themselves. Okay, all right, cool, um okay, so the question. So this is you and then the other? We have one other like small issue related to custom roles.

B

That's not a blocker currently, but it is part 15 7.. um This thing that I wanted to ask you. ah So we had this conversation about rolling. uh This feature flag out to specific customers, so right now, I just enabled the feature flag on galap.com for one test group. That's all I've done it's not rolled out to everybody and it wouldn't even be usable if it was but I think the open question is and I know you mentioned. This is for ultimate.

B

Only I need to do some digging to make sure that we are enforcing that on our side in the code.

B

um I know that's the intention, but I, don't I, don't remember if we actually like wrote code for that um so for the customers. Did you have a customer list that you wanted to roll this out to do you think we should roll it out to all ultimate customers at the same time? What were you thinking.

A

um Do you think there is what would be the downside to Rolling it out to all customers, since it's something that somebody would have to opt into right? Is there much risk.

B

There do you think um there might be some risks, so when the feature flag is enabled we start doing a lookup each time on. Is there a custom role here? So there is the potential for performance issues.

B

um I haven't seen any on gitlab.com, but we had a discussion with the scalability team and they basically were like yeah. It's hard, it's hard to say just by like clicking around as one user.

B

If there's like a scalability problem, so rolling it out more slowly uh would ensure that we can kind of catch that before we have a bunch of users using custom roles um and or using it or not using it, but they're opted in, and so they are subject to those more complex, SQL queries that we're doing to see is there a custom role? Is there a custom role so I think from like a risk mitigation perspective, it's probably ideal to not roll it out to everybody.

B

um I think the other thing just like from my experience in the past with alphas and betas, is like, if you tell a customer like. Oh, this is a cool new Alpha feature. Do you want to test it and then it like isn't perfect, they're, probably going to be more accepting of that than if we just rolled out to everyone and we're like whoever wants to test it? And then people are like. Oh this, isn't you know this isn't perfect or this is you know all right so.

A

If there were some customers.

B

That you have a good relationship with that. You know want this, that might get value out of this first little piece. We could roll out just to them for a little while and see how it goes. Yep.

A

Let me get back to you with that list. I can definitely reach out. I know, there's a lot of customer interest, so I'll get the wheels turning there, um but it would it be ready to. Could we I guess we're still waiting for the API endpoints right.

B

A

B

Is the last thing yeah that would block somebody from ongitlab.com actually use this, so we do need that still, but it hopefully you know this relief I think it's a higher priority. Okay,.

A

Awesome foreign.

B

Flag roll out and then the ultimate only um I was gonna. Look through the code history just because that was like not really top of mind. For me, when I was working on it, it might have already. Somebody might have already added logic somewhere. That makes sure only ultimate customers. Commerce can use this, but I'm not positive, um and then I have this docs Mr draft, which I think we would finalize after. Oh, my gosh, how do you do pull it?

B

Okay, I'll, stop quickly. um Anyways I have that and then you had some marketing things or other promotional materials. Yeah.

A

I can explain to you a little bit about what we have going on so I kind of reached out and was like what are the ways we can spread. The word about this um so I'm doing a blog post, which I will send to you. um I'm still drafting it, um but I'll send that to you um and then we have a you can do an announcement request, um which I think is kind of like the different teams that have more of the public face of gitlab on our Twitter and whatnot um on our LinkedIn.

A

They make noise about things um as necessary, so that's an option as well and I put in a request for that, um and then the last thing is um something that whenever I was thinking about how we can gauge the impact that this is having like the whole uh sort of idea behind doing this MVC was that um the guest user doesn't have enough privilege to be useful.

A

um Once we give it this new level of privilege, it will help with selling the Ultimate upgrades, because potentially people who have a paid reporter seat could use a free guest seat instead.

A

um So I'm working on a proposal with growth team and the digital experience team to try to figure out how we can get that we're we're still iterating, but it might be some kind of calculator or something for current premium customers where we say Hey, you know if in-app somewhere, hey if you upgraded to Ultimate and um uh you could move some of your reporters to guests for because they're free on Ultimate and kind of like here's, the calculator, some kind of slider. We we're looking at how different other companies uh do a similar thing.

A

But that's I, don't know we're trying to be um I, guess engaging in how this can help with upgrades and also we want to. um We don't have this figured out yet but instrument like how can we know for sure if that, if this is one of the things that led to an upgrade right.

B

Okay, um okay, that's cool um one thing: I have a question I had about. All of this is before we go out and announce that this exists in a broader way. Do you think and I know like we're doing an MVC? It's an iterative approach so, like I, feel from a development perspective. I feel very good about like how little we've.

A

Done and I'm like it's very.

B

Small, like we're doing it, um there is no way to validate in the UI that basically I. If you remember from the demo, video I did a custom guest will look just like a guest in the UI and um I'm, not even sure like we don't have an up and a plan currently for how that would be viewed or who is a custom guest? Who can view code here?

B

So um one question I have is like: do we need something like that, even if it's just a like a taste of like that, wouldn't be a full-fledged feature, but like some way to just be like? Oh, this is the custom guest. This is custom guest, as opposed to being completely invisible to another.

A

um That's a good point: do we have so we wouldn't have a way today. If we did it via the API and pulled back our list of users, it would still they would. Even if they were custom guests, they would still come back as guests.

B

Yes, there we have not. There is an the way that this was implemented. It's just an additional attribute on the members table that it's like a custom. It's like member role, ID and then you have to connect over. So we haven't exposed via the API that additional attribute of the member record that would indicate that a role is a guest role, so it still looks like it is still a guest role in the database, so it's accurate, but it's like, and it has this custom thing attached to it. I.

A

Don't think that's a blocker for getting this out I think that could be something that could be a fast follow type of thing in a in the next Milestone. Maybe um and I can rate that up. Let me make myself a note. That's a good point.

B

um Yeah I just know what I mean, as you remember, I like got confused as I was demoing. It I was like, and this is this account- is the regular guest. Oh wait! No that's the custom guest, because I was just looking at the UI and I hadn't remembered what I'd set up before and so I just imagined that admins might be like. Why didn't you just put something in here? It's not it's not easy, but.

A

Okay, I think we can document that that you know is one of the limitations uh for the MVC and yeah I. Don't think that should stop us.

B

Okay, I can add up to the documentation. Mr awesome.

A

And I'll make a I'll make an issue for that.

B

Okay, yeah, that would be good I, think that would be really helpful, um great yeah. So it's it's all working so I, wrote I'll! Add you to this little note: stock I just started it I, don't even know if you usually take notes in Google drive, but I just thought I would do something. Okay,.

A

All right well, thank you. Yeah I, think that gives me a good idea of where we are I'll, get back to you with the um with the list of customers, and let me know when we're ready to start doing that great all.

B

A

Jesse thanks bye.

B