Which permissions does a user need to be able to create a project?

[luebbe]

Is there a site wide role or group that allows users to create tanslations projects?

The projects are "public".

By default all users are in the groups "users" and "viewers". They can neither create projects nor components.
If a user is added to the "managers" group, (s)he can create components, but not projects.

I tried adding a group with the roles "access repository" and "manage repository", but the user(s) with this role still can't create translation projects. I guess this is only for per-project access control.

I can obviously make everybody "superuser", but that's not my intention. Is there something in between, which allows users to create projects and components, but not be able to mess with the django settings?

[nijel]

See https://docs.weblate.org/en/latest/admin/projects.html#adding-translation-projects-and-components

[luebbe]

That's exactly the information I'm not finding. First paragraph of your reference:

Based on your permissions, new translation projects and components can be created. It is always permitted for users with the Add new projects permission, and if your instance uses billing (e.g. like https://hosted.weblate.org/ see Billing), you can also create those based on your plans allowance from the user account that manages billing.

Where can I set the add new projects permission?

There is no "add new project" role visible in Django. Is it hidden in the many permissions of the different roles?

Maybe it's a translation/terminology problem again. The Django interface is partly German, partly English and the German translations don't always match the English terms in the documentaion.

[nijel]

There is no existing Role for that, it's a Permission name.

[luebbe]

This is honestly driving me nuts. Meanwhile I switched the UI to English, because the German UI translation makes it worse.

This is what I did:

1. Create a role "Manage projects and components with the following permissions:
   • Add new project (site wide)
   • Edit project settings
   • Edit component settings
   • Manage component lists (site-wide)
2. Create new group "Manage projects" with the newly created role
3. Add user to the "Manage projects" group

This user now can create projects, but not components. The predefined "Manager" group obviously inherits a permission from the "Adminstration" role that allows to add components and I can't find out which.

I'm trying to find a minimal set of permissions that a user needs in order to be able to create projects and components within a project. Spent the entire morning for this, switching between docs and admin interface, a lot of trial and error and no success yet.

I'm missing a "reverse" view from the point of view of the permissions, so I can tell which groups have a certain permission.

[nijel]

The user which created the project should be automatically added to group Project name@Administration to be able to create components there. This group is created upon creating the project (unless you've changed DEFAULT_ACCESS_CONTROL).

[luebbe]

No, I didn't change DEFAULT_ACCESS_CONTROL, but this is valuable information. This morning I created a project for a user, because he (as Manager) couldn't. So he wasn't member of the Project name@Administration group of this particular project.

Later I created the above permission group and added him to the group. On paper this looked like he now should be able to create both.

Since we're all working remotely I couldn't look over his shoulder and see where he was trying to add a project or component. So he probably couldn't create a component in the project that I created for him, because he still wasn't a member of the Project name@Administration group.
I'll go through this loop a few more times with him and see if everything is sorted out if he starts from scratch.

So which is the minimal set of permissions on top of being a member of "Viewers,Users" that a user needs in order to be able to create projects and components within a project that he has created as well as delete a project that he has created. Is "Add new project (site wide)" sufficient?

[luebbe]

It looks like these steps solve the problem:

1. Create a role "Manage projects" with the following permissions:
   • Add new project (site wide)
2. Create new group "Manage projects" with the newly created role
3. Add user to the "Manage projects" group