Allow Developers to create "Membership Policies" which Site Administrators can apply to the portal

We need to implement a framework within the portal that is able to apply custom membership policies. In order to implement a custom membership policy it will be necessary to write a Hook Plugin which contains an implementation of the MembershipPolicyFactory.

The MembershipPolicyFactory implementation will need to be able to provide the following information:

• For any given User object and Group object (which represents a site):
  • Whether membership is allowed: This will be used to deny membership when the membership operation occurs. If the policy is changed afterwards the existing memberships will be revoked the next time the user logs in (see below).
  • Whether membership is mandatory: The user should be considered member of the site always.
  • What site roles are mandatory for the user: If the user should always have certain Site Roles when being a member of the site, a list of such role should be specified.
  • What site roles are forbidden for the user. If the user has those roles they should be removed. The system won't allow assigning those roles.

• For a given user:
  • All the sites to which the user must always be a member.

The portal will use this API to enforce the membership policy in the following situations:

• Once for every site when the user logs in:
  • Each membership of the user would need to be checked to ensure that the user is still allowed to keep that membership.
  • If the policy mandates that the user must be a member of a site that he is not yet a member of, the membership should be automatically created.
  • Additional roles will need to be assigned to all remaining site memberships. Existing roles will never be removed since the portal will not know whether they were assigned automatically due to a previous policy or manually and intentionally.

• Once for every site when the user is added or removed from a site.
  • If the user is not allowed to become a member of the site, a proper message should be
    shown to the user requesting the membership.
  • If any role is mandatory it should be assigned to the user automatically..

• Once when a site role is assigned to/unassigned from a user
  • Assign: The membership policy should be checked to verify is the role is among the list of
    forbidden roles.
  • Unassign: The membership policy should be checked to verify is the role is among the list of
    mandatory roles.

The Hook Plugin will also allow to customize the form used to create or edit a site to add specific fields that will be used by the Java class mentioned in the previous point. It is worth noting that the hook is responsible for determining the way to store the information introduced through these additional field.