Replace "yes/no" permissions with `yes/no/never`

[rafalp]

phpBB3 and XenForo provide third "never" option to permissions, that make it quick and painless to remove a permission by creating new group/role like "Feature XYZ disabled" that has this permission's value set to never.

Algebra for this is:

no  x no  = no
yes x no  = yes
nvr x no  = no
nvr x yes = no

Screenshots:

In the database we could represent those as -1, 0, 1 short int field.

We should also update _build_user_permissions_action to loop per group via util:

permissions = {
    "perm_name": yes_no_never([group.perm_name for group in groups]),
    "perm_limit": max_or_zero([group.perm_name for group in groups]),
}

This will be slower than current approach, but we are caching those anyway.

[rafalp]

I'll give this "decision needed" because it will require me to investigate how this will play at bigger picture.

What if I want to restrict feature X for the user? I create a "Can't do X" group and assign it to them. But now this group will also have default limit for other feature set to 0 (default value for limits). And this 0 will remove a limit from other feature, (eg. time limit for editing own post). Solution for this would be only taking limit from a group if it also grants permission to use this feature (eg. group.own_posts_edit_time_limit is only used if group.can_edit_own_posts is yes)

[ShiningVenus]

I definitely would like this down the line! I prefer yes/no/never or something over yes/no. Make it more like how other forums have their permissions systems!

[rafalp]

Yeah, this feature sounds good, but I'll have to first make sure it makes sense for existing permissions on the 0.40 branch before I can decide to implement it or not.