After upgrade from previous CVAT version, users unable to see any task or project unless they are admin

[kwikwag]

My actions before raising this issue

• [x] Read/searched the docs
• [x] Searched past issues

After upgrading to CVAT 2.1 from 1.3 (IIRC) and creating a new user, unless that user is admin, they cannot see any existing projects.

I have noticed there is a new 'organization' structure. However, after I create a new organization it shows up empty, and there is no way, not even in the Django admin, to move projects between organizations.

Inviting new users into an organization works with user emails and not user names, which is unintuitive, since our CVAT installation is internal.

It is unclear what belonging to each "group" in the Django admin site allows users to do, and there is no documentation on it. In addition, it is unclear how Django "groups" and organization member roles interact (if I am in the Django "admin" group but the organization "worker" group, what can I do? If I am in the Django "observer" group but an organization "supervisor", what can I do?)

Expected Behaviour

Access to tasks/projects for users with non-admin roles should be preserved upon upgrade. Django group permissions, organization role permissions, as well as their interaction should be clearly documented.

Current Behaviour

Users that are not admins do not have access to projects/tasks created by other users. There is some documentation. There is an empty page which supposedly should contain documentation for Django admin page group permissions (IAM system roles), or their interaction with organization permissions.

Possible Solution

1a. A user should be able to either see projects from previous versions of CVAT even if they are not an admin. 1b. Alternatively, there should be an easy way to migrate projects into organizations - in which case projects from previous versions of CVAT should be under a "Common" or "Shared" organization as otherwise non-admin users are unable to see them. 2. In addition, users should be allowed to be added to organizations not only by e-mail but also by user name. 3. The upgrade guide which currently is part of the FAQ probably needs its own page and needs to include migration information for people upgrading from versions prior to PR #3788 (19 Jan 2022) 4. There should be an easy way to transfer a project to a different organization or back to the personal workspace. (#4202 ) 5. Documentation for IAM system roles, supposedly for 'Admin page' groups, should be filled in. Both this page and the Organizations page should contain some information about interactions between permission schemes (perhaps explain how to read the tasks.csv file?). (#3482 )

Steps to Reproduce (for bugs)

1. Install CVAT 1.3.0
2. Create a project and some tasks
3. Add another user as an annotator
4. The annotator will have access to tasks you have created
5. Upgrade to CVAT 2.1.0
6. The annotator no longer has access to tasks you have created

Context

Written above.

Your Environment

• Git hash commit (git log -1): tag v2.1.0 Merge: e33db5c2 119a27bb
• Docker version docker version (e.g. Docker 17.0.05): Docker version 20.10.7, build f0df350
• Are you using Docker Swarm or Kubernetes? No
• Operating System and version (e.g. Linux, Windows, MacOS): Ubuntu 20.04.2 LTS
• Code example or link to GitHub repo or gist to reproduce problem: N/A
• Other diagnostic information / logs: N/A

[nmanovic]

@kwikwag , thanks for the report. I agree that we need to implement an option to move projects and tasks to/from an organization. Soon we will publish an article about IAM in CVAT. I hope it will clarify some design decisions.

[Daniel451]

@nmanovic the new organization spaces and everything around it (or at least what I read and understood about it) seems very reasonable but publishing this feature in stable releases is, in my opinion, premature if there is no possibility to move projects/tasks and not even an intuitive way to assign people to organization. Even within the admin console the organizations are effectively invisible and there is no easy way to add people to organizations other than ensuring they all have a mail address entered and then entering exactly this mail address to the organization (there should at least be username based adding support and auto completion of usernames/mail address).