Is the same package installed per user or installed once and permission is granted to users?

[FreePhoenix888]

Example

There are users 1 and 2 in my deep
If both users install package my-package-name will there be two copies of that package per each user or only one package will be installed and both users will get permissions to the package?

[Konard]

@FreePhoenix888

1. Only admin users can install packages or users that have (AllowInsertType) permission for Install link type.
2. Only admin users can see installed packages or users that have (AllowSelectType) permission for Package, PackageVersion, PackageActive, PackageNamespace links.
3. If the user have select permissions for packages, he will see the package as installed, and may not install it twice.
4. If user have insert permissions for Install link, it can install package twice.
5. Package installation is system wide, it is not linked to users in any meaningful way. Well if user install package, the Contain link is created and if user decides to share his permissions with package he may create a Join link from Package to User.
6. Package has own permissions and in that case acts as a separate user.
7. We do not hive permissions to use packages. We give Select/Insert/Update/Delete permissions on each link inside the package.
8. For example, we have Install and Publish links in npm-packager. We don't give permission to work with npm-packager package, instead we give users separate permissions to operations up on Install/Publish links. Only user who can insert Install/Publish links can trigger npm-packager or other packages' handlers. And these handlers will be executed with the permissions that were given to package, but not from package to user.

[FreePhoenix888]

@Konard

1. Only admin users can install packages or users that have (AllowInsertType) permission for Install link type.

👍🏻 . Will a user have permissions to do it if I create Join link from the user to the user that has these permissions (for example admin)

2. Only admin users can see installed packages or users that have (AllowSelectType) permission for Package, PackageVersion, PackageActive, PackageNamespace links.

👍🏻

5. Package installation is system wide, it is not linked to users in any meaningful way. Well if user install package, the Contain link is created and if user decides to share his permissions with package he may create a Join link from Package to User.

Can a user change package links?
If yes - it is unsecure. Other users will be under the change to use the package with malicious code in handlers

6. Package has own permissions and in that case acts as a separate user.

👍🏻

7. We do not hive permissions to use packages. We give Select/Insert/Update/Delete permissions on each link inside the package.

👍🏻. Then answer to my previous question is "No"?

8. For example, we have Install and Publish links in npm-packager. We don't give permission to work with npm-packager package, instead we give users separate permissions to operations up on Install/Publish links. Only user who can insert Install/Publish links can trigger npm-packager or other packages' handlers. And these handlers will be executed with the permissions that were given to package, but not from package to user.

👍🏻

[Konard]

@FreePhoenix888

Will a user have permissions to do it if I create Join link from the user to the user that has these permissions (for example admin)

Join link shares all permissions from User to User. So yes, if you create Join link to admin from the user that user will have permissions to install packages. You can also create a specific Rule with Action - AllowInsertType, Subject - new user, Object - Install type link.

Can a user change package links?
If yes - it is unsecure. Other users will be under the change to use the package with malicious code in handlers

Admin can do everything, regular user cannot access Package links (if it can, it is a bug).

Then answer to my previous question is "No"?

There will be two copies of the package if two separate users install it. Installation of package does not give any permissions for user or package.