Apply default actions to default roles for new events/series

[Arnei]

Fixes #1354.

An admin can configure actions that are automatically added to each role you add to an ACL in the ACL tab for series and events. However, they were not applied to default user role the ACL is initialized with. This adds the actions to default user role.

How to test this

Configure additional actions in your Opencast configuration. Check etc/listproviders/acl.additional.actions.properties and etc/listproviders/acl.default.create.properties and configure an action there. Then try creating an event and a series.

[github-actions]

Use docker or podman to test this pull request locally.

Run test server using develop.opencast.org as backend:

podman run --rm -it -p 127.0.0.1:3000:3000 ghcr.io/opencast/opencast-admin-interface:pr-1360

Specify a different backend like stable.opencast.org:

podman run --rm -it -p 127.0.0.1:3000:3000 -e PROXY_TARGET=https://stable.opencast.org ghcr.io/opencast/opencast-admin-interface:pr-1360

It may take a few seconds for the interface to spin up.
It will then be available at http://127.0.0.1:3000.
For more options you can pass on to the proxy, take a look at the README.md.

[github-actions]

This pull request is deployed at test.admin-interface.opencast.org/1360/2025-07-09_13-08-41/ .
It might take a few minutes for it to become available.

[snoesberger]

I tried to test this PR, but when I open the new series dialogue, I can't define the metadata and proceed to the next step.

I tried it with the same result in both our test environment and https://develop.opencast.org

[Arnei]

I tried to test this PR, but when I open the new series dialogue, I can't define the metadata and proceed to the next step.

I tried it with the same result in both our test environment and https://develop.opencast.org

Likely fixed by #1340

[snoesberger]

Likely fixed by #1340

You are right, if I add this commit, I'm again able to create series.

However, I found an other problem. The custom actions are now added correctly for the default user. However, if I change the ACL template, the custom actions are removed again from the default user. This happens not only with new series, but also with existing ones. Additionally, when I change the template of an existing series, all the user ACLs are removed and only the editor's user ACL is added.

[Arnei]

However, if I change the ACL template, the custom actions are removed again from the default user.

Thanks for catching that, should be fixed now.

Additionally, when I change the template of an existing series, all the user ACLs are removed and only the editor's user ACL is added.

Afaik when switching templates, all changes made by the user are discarded. So after switching a template, only the roles specified by the template + the default user role are set. Wether that constitutes reasonable behaviour or not I cannot say. In any case, that discussion is probably better left for a different issue/PR.

[snoesberger]

Additionally, when I change the template of an existing series, all the user ACLs are removed and only the editor's user ACL is added.

Afaik when switching templates, all changes made by the user are discarded. So after switching a template, only the roles specified by the template + the default user role are set. Wether that constitutes reasonable behaviour or not I cannot say. In any case, that discussion is probably better left for a different issue/PR.

In our case, we use the templates to regulate the access authorizations for Tobira. We use templates that contain roles which grant permissions based on users' organizational affiliations. For example, this means that we can only allow members of our institution to access certain series/events in Tobira.
Directly authorized users are owners of the corresponding series/events for us. Accordingly, we only want group authorizations to change when the template changes, not the owners. We have series with over 100 directly authorized users. If someone wants to change the template, for example, to make the series publicly available on Tobira instead of only to members of our institution, the 100+ users would lose their write access to the series.

By the way, in the old admin UI, user ACLs weren't removed when changing the template.

New issue to fix this: #1364

[snoesberger]

As you mentioned in #1364, configuring keep_on_template_switch_role_prefixes in etc/listproviders/acl.default.create.properties should prevent the removal of user roles when switching templates. However, this isn't the case anymore with this PR.

[Arnei]

Thanks for catching that, should be fixed now.

[snoesberger]

Thanks @Arnei for fixing this. Default actions are now applied as expected and the configuration of keep_on_template_switch_role_prefixes is being considered again.

[github-actions]

This pull request has conflicts ☹
Please resolve those so we can review the pull request.
Thanks.

[github-actions]

This pull request has conflicts ☹
Please resolve those so we can review the pull request.
Thanks.