Document about auth managers refactor

[humitos]

Document with current behavior, problems, ideas and notes about how to refactor our custom QuerySet and managers to manage permissions in just one place instead of many different files.

This is a first draft to start the discussion on the direction we will take.

APIv3 implementation (#5356) raised some of the problems listed here: public detail and private listing on resources.

[ericholscher]

I think I like this approach. I think my current view is:

• We should only have public, private, and for_user queryset methods that we support
• We should build mixins for all the cases that we currently care about, and apply them to the API & Dashboard views consistently
• If we come to places where we are repeating logic more than 2x, we can consider bringing them back into the querysets, but I think keeping the queryset managers simple and having the mixins hold the integration with the code feels best

The main value here is that the integration of the queryset managers into the code only happens in one place, instead of in each view. This should ensure that we have the same logic in all our views.

[ericholscher]

@stsewd Are you planning to do the auth refactor? Is it based on this design doc?

[stsewd]

@ericholscher this is for querysets/managers, I'm doing the auth backend :)

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.