Move MTM user restrictions to the general settings, instead of the user settings.

[Stan-vw]

Currently, some MTM usage restrictions are available on a user level.

Observation: This creates a lot of manual work to managing large Matomo installations, and it's easy to miss/forget about the specific settings, and the reasons to make/keep them like that.

Suggestion: Move MTM user restrictions to the general settings (instead of user settings) so that they can be managed across the entire website efficiently.

Current config:

Suggested config:

Questions:

1. Are there specific reasons this was done on a user level rather than a MTM-wide level based on roles?
2. If yes, do these reasons weigh up against the added efficiency of managing it on a role level?

[AltamashShaikh]

@tsteur Are you aware of any reason why this was done per user level ?

[sgiehl]

This was done on user level, as you might want specific users to be able to use the TagManager, while others shouldn't be able to. You might not want to give someone admin or write access to be able to use the TagManager.
We also can't change that easily, as it would be a breaking change.
What you could implement in TagManager is maybe an overview, that shows which users are currently allowed to use the TagManager in which way, and maybe give the possibility to apply the TagManager permissions to all users with a specific role.

A better solution might be to let the (super) user decide, if he wants to use TagManager permissions or grant those automatically to certain roles. But that would require something like: matomo-org/matomo#21175

[tsteur]

@AltamashShaikh as Stefan says that's done for security reasons.
Say you have 30 users with write permissions. You don't want to give all of them access to do certain actions like publish new versions or write custom JavaScript etc. It'd be only very few people that should have this access.

And there is always the possibility that a user gives "Admin" permission and then the fine granular access isn't needed as they are included in that role.

[Stan-vw]

Ah ok, yes I guess there is a "default permission level per role", such as admin users are able to publish but view users are not. This feature would effectively allow you to overwrite that, but I see that there's currently the hypothesis/insight that users prefer to do this on a personal level so they can differentiate better within certain levels (e.g. 1 admin can publish while the other cannot).

I'll leave this open as an idea, but it's unlikely it gets picked up until we get more clear interest from customers/users 👍