Since Panopoly includes one or more roles exported to a feature module, should we include the role_export module?
The Role Export module allows roles to have machine_names and generates a unique role id (rid) based off of the machine_name. Roles can be exported with Features and get the exact same rid if imported on other sites. Because of this unique rid there is no need to create plugins per contrib module that use the rid in their export code, such as Views, Ctools, Rules, etc. References to this role id will not break on other sites.
This could help avoid any potential issues with adding panopoly modules to existing sites or when used as a base distro. I think all that would be needed here would be to add the module to the .make/.info files and then re-export the roles with a machine_name (e.g. panopoly_editor).
Comment | File | Size | Author |
---|---|---|---|
#12 | panopoly_core-role_export-2186551-12.patch | 1.94 KB | caschbre |
#8 | panopoly_test-role_export-2186551-8.patch | 586 bytes | caschbre |
#7 | panopoly_widgets-role_export-2186551-7.patch | 612 bytes | caschbre |
#7 | panopoly_admin-role_export-2186551-7.patch | 532 bytes | caschbre |
Comments
Comment #1
mrfelton CreditAttribution: mrfelton commentedI'm definitely for this. We use role_export in every other platform that we manage. I was surprised it wasn't in Panopoly already but maybe there was a reason?
Comment #2
caschbre CreditAttribution: caschbre commentedI can create a patch for this.
Other than assigning the roles a machine_name, can you think of anything else we'd have to update?
Comment #3
mrfelton CreditAttribution: mrfelton commentedWe would need to check if we reference roles by their numerical ID anywhere and update the references, since once you assign a machine name, the numerical ID's of each role will change (they are calculated automatically based on the machine name).
Comment #4
caschbre CreditAttribution: caschbre commentedAttached are two patches (panopoly_core & panopoly_admin) that includes role_export in the .make / .info files.
Changes include:
* administrator role machine_name = administrator
* editor role machine_name = panopoly_editor
* added role_export to panopoly_core .make/.info files
* added role_export to panopoly_admin .info file
* added panopoly_core dependency to panopoly_admin
I would think that anyone using panopoly_admin would also be using panopoly_core, but that last change could have significant impact. But given the new panopoly_admin export uses role_export IDs from panopoly_core I'm not sure there's a way around that.
Comment #5
mrfelton CreditAttribution: mrfelton commentedOne way to do this without requiring panopoly_core as a dependency in panopoly_admin would be to implement
hook_strongarm_alter()
, and in that hook usemodule_exists()
to check if panopoly_core is enabled and if so, alter the value of the user_admin_role variable. However, doing so would result in the feature appearing as overridden since Features doesn't properly handle defaults_alter hooks yet and reports them as overriden even if the override is implemented via alter hooks. Plus, what we have there currently references the rid '3' - which is completely meaningless so changing it to '30037204' isn't any worse. With that in mind, I think we could get away without introducing the dependency on panopoly_core, though I have no idea if anyone is actually using panopoly_admin it without also using panopoly_core. Usage stats show:panopoly_admin: 2,136
panopoly_core: 2,363
Also, I can see one other places where role ids are referenced in the code:
panopoly_widgets.views_default.inc:187
Also, what is the logic behind using the panopoly_ prefix for the editor role, but not for the administrator role?
Comment #6
caschbre CreditAttribution: caschbre commentedIf we don't have a dependency on panopoly_core and someone just has panopoly_admin enabled, would that throw up an error?
The panopoly_ prefix on the editor role was to avoid any conflict with a distro based on Panopoly from conflicting with the 'editor' role. I don't remember if I just missed it on the administrator role or if I had a reason for it. Should we put the prefix on both roles or leave it off of both roles?
Comment #7
caschbre CreditAttribution: caschbre commentedHere are updated patches for core, admin, and widgets.
* No panopoly_core dependency
* consistent role machine names
Comment #8
caschbre CreditAttribution: caschbre commentedHere's an login.feature for panopoly_tests since that had a role ID in there.
Comment #9
dsnopekI haven't tested this yet, and while I'm in support of role_export in general, I'm worried about upgrading existing sites.
After upgrade, will there now be two 'administrator' roles: one with the rid 4 and the other with an rid of 30037204? How will this affect other things that store the old rid like Rules, Views, etc some of which may been created by the site builder (ie. not the distro)?
Given the number of possible things that can store rid, I don't think we can do an automatic conversion from the old rid to the new...
Comment #10
caschbre CreditAttribution: caschbre commentedThere shouldn't be two administrator roles. role_export adds a column to the roles table for the machine_name. And I believe the ID generated is based on that machine name so the values should be consistent.
I don't think we can do anything about things outside of panopoly that are based on a role's rid. Child distros should be able to re-export their features to pick up the new rid. And some of them (e.g. openatrium) already use role_export.
This probably has to be one of those things we call out in the release notes that an admin may require manual intervention/updates.
I'd also add though that it's not ideal to export stuff based on database IDs. That can get painful. role_export helps alleviate that similar to how uuid works in other cases.
Comment #11
caschbre CreditAttribution: caschbre commentedMarking as needs work.
The patches work for new installations, however for an upgrade we need to manually insert the machine name into the roles table in an update hook.
Comment #12
caschbre CreditAttribution: caschbre commentedHere's an updated panopoly_core patch that handles the upgrade path.
Comment #13
dsnopekI'm marking this as postponed on plans for a Panopoly 2.x, since the upgrade path would be problematic: #2334091: Panopoly 7.x-2.x hitlist
Comment #14
lsolesen CreditAttribution: lsolesen commentedCould this be reconsidered. Read this and this might help on the upgrade path? https://drupal.psu.edu/blog/post/d7-features-secret-rolemageddon
Comment #15
dsnopekThat's a pretty sweet patch! And I think it's the start of a partial solution to this problem. However, even if it handled 90% of all contrib modules, I still would rather not add role_export for Panopoly 1.x because it's meant to be stable.
If we end up doing a 2.x branch for Drupal 7, this is the first thing we should commit. :-) But my focus personally is going to be on getting Panopoly 1.x into maintanence mode, and working on Panopoly 2.x for Drupal 8.