Since Panopoly includes one or more roles exported to a feature module, should we include the role_export module?

The Role Export module allows roles to have machine_names and generates a unique role id (rid) based off of the machine_name. Roles can be exported with Features and get the exact same rid if imported on other sites. Because of this unique rid there is no need to create plugins per contrib module that use the rid in their export code, such as Views, Ctools, Rules, etc. References to this role id will not break on other sites.

This could help avoid any potential issues with adding panopoly modules to existing sites or when used as a base distro. I think all that would be needed here would be to add the module to the .make/.info files and then re-export the roles with a machine_name (e.g. panopoly_editor).

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

mrfelton’s picture

I'm definitely for this. We use role_export in every other platform that we manage. I was surprised it wasn't in Panopoly already but maybe there was a reason?

caschbre’s picture

Assigned: Unassigned » caschbre

I can create a patch for this.

Other than assigning the roles a machine_name, can you think of anything else we'd have to update?

mrfelton’s picture

We would need to check if we reference roles by their numerical ID anywhere and update the references, since once you assign a machine name, the numerical ID's of each role will change (they are calculated automatically based on the machine name).

caschbre’s picture

Attached are two patches (panopoly_core & panopoly_admin) that includes role_export in the .make / .info files.

Changes include:
* administrator role machine_name = administrator
* editor role machine_name = panopoly_editor
* added role_export to panopoly_core .make/.info files
* added role_export to panopoly_admin .info file
* added panopoly_core dependency to panopoly_admin

I would think that anyone using panopoly_admin would also be using panopoly_core, but that last change could have significant impact. But given the new panopoly_admin export uses role_export IDs from panopoly_core I'm not sure there's a way around that.

mrfelton’s picture

Status: Needs review » Needs work

One way to do this without requiring panopoly_core as a dependency in panopoly_admin would be to implement hook_strongarm_alter(), and in that hook use module_exists() to check if panopoly_core is enabled and if so, alter the value of the user_admin_role variable. However, doing so would result in the feature appearing as overridden since Features doesn't properly handle defaults_alter hooks yet and reports them as overriden even if the override is implemented via alter hooks. Plus, what we have there currently references the rid '3' - which is completely meaningless so changing it to '30037204' isn't any worse. With that in mind, I think we could get away without introducing the dependency on panopoly_core, though I have no idea if anyone is actually using panopoly_admin it without also using panopoly_core. Usage stats show:

panopoly_admin: 2,136
panopoly_core: 2,363

Also, I can see one other places where role ids are referenced in the code:

panopoly_widgets.views_default.inc:187

  $handler->display->display_options['filters']['type']['expose']['remember_roles'] = array(
    2 => '2',
    1 => 0,
    3 => 0,
    4 => 0,
  );

Also, what is the logic behind using the panopoly_ prefix for the editor role, but not for the administrator role?

caschbre’s picture

If we don't have a dependency on panopoly_core and someone just has panopoly_admin enabled, would that throw up an error?

The panopoly_ prefix on the editor role was to avoid any conflict with a distro based on Panopoly from conflicting with the 'editor' role. I don't remember if I just missed it on the administrator role or if I had a reason for it. Should we put the prefix on both roles or leave it off of both roles?

caschbre’s picture

Here are updated patches for core, admin, and widgets.

* No panopoly_core dependency
* consistent role machine names

caschbre’s picture

Here's an login.feature for panopoly_tests since that had a role ID in there.

dsnopek’s picture

I haven't tested this yet, and while I'm in support of role_export in general, I'm worried about upgrading existing sites.

After upgrade, will there now be two 'administrator' roles: one with the rid 4 and the other with an rid of 30037204? How will this affect other things that store the old rid like Rules, Views, etc some of which may been created by the site builder (ie. not the distro)?

Given the number of possible things that can store rid, I don't think we can do an automatic conversion from the old rid to the new...

caschbre’s picture

There shouldn't be two administrator roles. role_export adds a column to the roles table for the machine_name. And I believe the ID generated is based on that machine name so the values should be consistent.

I don't think we can do anything about things outside of panopoly that are based on a role's rid. Child distros should be able to re-export their features to pick up the new rid. And some of them (e.g. openatrium) already use role_export.

This probably has to be one of those things we call out in the release notes that an admin may require manual intervention/updates.

I'd also add though that it's not ideal to export stuff based on database IDs. That can get painful. role_export helps alleviate that similar to how uuid works in other cases.

caschbre’s picture

Status: Needs review » Needs work

Marking as needs work.

The patches work for new installations, however for an upgrade we need to manually insert the machine name into the roles table in an update hook.

caschbre’s picture

Status: Needs work » Needs review
FileSize
1.94 KB

Here's an updated panopoly_core patch that handles the upgrade path.

dsnopek’s picture

Status: Needs review » Postponed

I'm marking this as postponed on plans for a Panopoly 2.x, since the upgrade path would be problematic: #2334091: Panopoly 7.x-2.x hitlist

lsolesen’s picture

Could this be reconsidered. Read this and this might help on the upgrade path? https://drupal.psu.edu/blog/post/d7-features-secret-rolemageddon

dsnopek’s picture

That's a pretty sweet patch! And I think it's the start of a partial solution to this problem. However, even if it handled 90% of all contrib modules, I still would rather not add role_export for Panopoly 1.x because it's meant to be stable.

If we end up doing a 2.x branch for Drupal 7, this is the first thing we should commit. :-) But my focus personally is going to be on getting Panopoly 1.x into maintanence mode, and working on Panopoly 2.x for Drupal 8.