Permission/privilege transition about iris

[DougLau]

Since v5.43, a user's role has required a permission record to create new DMS messages. This should be documented better.

As a starting point:

INSERT INTO iris.permission (role, resource_n, access_n)
    SELECT name, 'dms', 4
    FROM iris.role
    WHERE enabled = true
    ON CONFLICT DO NOTHING;

This gives all roles full permission, but would need to be run again after new roles are created.

[gordonparikh]

Yeah I did something like that to get us working, it was easy enough to figure out given what I knew. I agree some additional documentation would be better, and a note in the release notes about that change (I see there is one about checking the DMS permission, but clarifying that it requires an additional step to configure would be good).

It would probably be ideal to figure out a way to approximately translate the existing privileges into the new permission system (at least in a "close enough" way) that can be added to a migrate script. It would require a little thought, but probably on par with the sign group -> hashtag transition. Maybe not a big priority until more things move over to the new system, but something to keep in mind. If you want some help with that, let us know.