Situation

At the moment, only superuser can:

• view the list of ABn Test in ABn Testing app
• create an new ABn Test

There are "editor, "publisher" roles installed by default in Magnolia.

Any users with those roles, they have access to Pages app, but if there is an AB Test setup on any page, they got error when access Pages app because a page is linked to an AB test which they have no access to ABn Testing workspace:

To setup an AB test that targeting specific audience (Segment), those users also need to have permission on Segments workspace. For instance, eric user can't see anything on Segments app at the moment.

Expected result

• The existing users with "editor", "publisher" roles should see the ABn Testing status in Pages app
• Have a separate ab-tester role for Admin 

Solution

1. Grant ReadOnly permission on ABTesting (Segments check) workspace to "editor", "publisher" roles 
2. Create a new role named "ab-tester" which provides to clients a convenience way to have user with a minimal permission to create and start AB test.
   Here are some permissions needed:
   • Read/Write on any sub-nodes from "/" on Website workspace
   • Read/Write on any sub-nodes from "/" on AB testing workspace
   • Read/Write on any sub-nodes from "/" on Segment workspace
   • Read/Write on any sub-nodes from "/" on Personas workspace
   • Read/Write on any sub-nodes from "/" on Dam workspace
   • ReadOnly on selected node "/ab-tester" on userRoles workspace
   • Web access on " * " with Get & Post
3. Also allow this role to see "Target" group in config.appLauncherLayout.groups.target because the existing "editor" role doesn't able to see the group (mean can see ABn Testing app)
4. Check the Read permission in TestStateColumnDefinition#apply (line 98) and {{HasRunningABTestRule#isAvailableFor }}(line 46) to avoid blocking exception in Pages app (users unable to expand the page tree)

Dev notes

Implement by using AddPermissionTask in ABTestingVersionHandler class 

Using PermissionUtil.isGranted(ABRepositoryConstants.WORKSPACE, "/", Session.ACTION_READ) to check permission