Figure out authorization for series

[JulianKniephoff]

This is currently mostly important in the page implemented for #359 (see #397) and for the "edit realm content" series select dialogue.

[LukasKalbertodt]

Some context and summary what this issue is actually about:

Series, like events and playlists, have an ACL. This is a list of role + action pairs that defines who can perform what actions on the series. For example (ROLE_FOO, write), (ROLE_BAR, read). For events it's straight forward: you can see the video only if you have a role that is mentioned in the ACL with read action. Same for changing anything about the event: you can only do that when the ACL grants you write access.

For series, it gets more confusing because a series' ACL serves a double purpose: to control access to the series itself and to be derived for its events. For example, if an event has no ACL at all and is part of a series, it derives the series ACL as its effective ACL. If both, event and series, have an ACL the exact behavior depends on the merge mode, but still: the series ACL can be derived.

Due to this, the semantics of controlling access to the series itself are unclear and different parts of Opencast (and the wider ecosystem) do things differently.

• Read access: who can see the series' title, description and other metadata? Is it controlled by the read action in the ACL? That would be the first guess, but parts of Opencast treat the series' metadata as always public to everyone. Tobira currently does the same.
• Modifying access: who can edit the series' metadata and ACL? This is controlled by the write action inside the ACL, as one would suspect. I think everyone agrees on this and Tobira also implements it like this.
• Adding events to series: Tobira currently requires write access to the series for this as well, but I'm not sure how other parts of the Opencast ecosystem solve this.

So the main question is about read access, with "add event to series" being a lower priority question.

The tasks of this issue are therefore:

• Research: figure out how Opencast and the wider ecosystem handle this.
• Community work & standardization: Very likely, there are differences. In that case, we all should agree on one model, document it and implement it everywhere.
• Once all that is done, Tobira might need to be adjusted to follow these semantics, but that's probably the smallest of the tasks.

[oas777]

• but parts of Opencast treat the series' metadata as always public to everyone. Tobira currently does the same.

Not sure whether we're supposed to chime in yet, but this raised my eyebrows with respect to "hidden" videos/series.

[LukasKalbertodt]

In today's meeting we decided this issue is low priority for us. It would be really nice to finally get this dealt with. But the plan is to do that as part of the "Opencast redo data model" project which should be happening some time next year.