Changing third party access for employee

[GDay]

In some cases, we might want to move an employee up or down the latter, or maybe to a different division. In that case, their accounts (made with integrations) perhaps won't match up anymore. They might need to be removed from one or more services and they might need access to new applications or get a different permission level at another integration.

This would be a somewhat larger feature, but could definitely be useful within larger companies. We would need the following:

A new "template" area (just like resources or badges) for these would hold all defaults per role/department or any other category that you want to create.

Every item there will hold a list of all integrations where each can be set by one of three options:

• Delete account (this would likely need Revoking third party access #315)
• Update account (with new defaults)
• Do nothing (regardless of current settings)

We will likely have two possibilities in terms of "updating an account".

1. They need to be added/removed from specific categories/tags/permissions. This means we need to remove existing ones and add new ones.
2. Their role/status needs to be changed. This means we only need to change one thing (for example: move from "manager" to "admin" role).

Asana example

Adding a user to new teams (option 1).

A lot of integrations have a "form" part. For example:

"form": [{
	"id": "TEAM_ID",
	"url": "https://app.asana.com/api/1.0/organizations/{{ORG}}/teams",
	"name": "Select team to add user to",
	"type": "choice",
	"data_from": "data",
	"choice_value": "gid",
	"choice_name": "name"
}],

This part will be the one that can be changed. We can already fetch the teams with the call we would normally make when we create this account. We need two more calls to update someones team (as we don't know what an admin would have changed manually).

We will need this info:

• Which teams the user already is assigned to
• Which teams the user needs to be assigned to
• Which teams the user needs to be removed from

We will likely end up with a new part in the manifest like this:

"update": {
    "TEAM_ID": {
         "existing": { 
             "url": ....
             "method": ....
         },
         "remove":  { 
             "url": ....
             "method": ....
         },
         "add": {
             "url": ....
             "method": ....
         },
    }
}

---

In the template, we can then group the items we want to assign to someone and which we want to remove. Remember, a template is universal, so the "remove" group might be bigger than the amount of groups the user is currently part of. That's fine.

Once we have created a few of templates, we can then manually assign such a template to the user, to change their permissions right away. Additionally, we might want to be able to customize this slightly before applying to the user, just in case the user still needs to have special access to some parts. This new page will list all the changes that would happen, this means the page will (1) check what permission the user currently has, (2) matches it to what the new permission would be and (3) displays the changes that would be made.