When using the template functionality, users able to copy or instantiate a template need to have the copy projects permission in the template project. As this is a regular membership, it prevails after a copy unless copying _all_ members are explicitly unselected during instantation. It would be nice to be able to differentiate access to the template project, vs templated memberships to be copied

### **Acceptance criteria**

* Begin of the insertionProjectEnd of the insertion Begin of the deletion (Project)End of the deletion administrators have a way to define roles that are not copied on template instantiation Begin of the insertion

* The project settings is expanded with a separate "Template" menu

* When the project is not a template, a blankslate is shown to enable it

* <img class="image_resized op-uc-image op-uc-image_inline" style="width:721px;" src="/api/v3/attachments/917590/content">

* When the project is a template, show a role selection for ProjectRole

* This selection is multi-select

* Once saved, these roles will be skiped on copy of this template

* This means, if a user only has these selected roles, they will NOT be copied

* If a user has these roles and another role not selected here, only that other role will remain


<img class="op-uc-image op-uc-image_inline" src="/api/v3/attachments/917591/content">

End of the insertion Begin of the deletion


End of the deletion ### **Technical notes**

Begin of the insertionDiscussed optionEnd of the insertion Begin of the deletion There are multiple possible waysEnd of the deletion to implement this:

Begin of the insertion##### Option 1: Per-template setting for excluded roles

End of the insertion <br>

Begin of the insertion* Add a store\_attribute :settings, :excluded\_role\_ids\_on\_copy, :array to Project (for templates only)

* During copy in MembersDependentService, check if the source project has this setting and filter accordingly


**Pros:**

* Most flexible, each template can have its own excluded roles

* Doesn&#39;t require changes and migrations to roles


**Cons:**

* You need to configure it per template

* Same role can be copied from one template but not another, which might be confusing


<br>

### Alternatives

> <br>
>
>End of the insertion ##### Option 1: Add a template\_role flag to ProjectRole Begin of the insertion
>
>End of the insertion Begin of the deletion

End of the deletion * Add a boolean column (e.g., template\_only) to the roles table Begin of the insertion
>
>End of the insertion Begin of the deletion

End of the deletion * Roles marked as template\_only: true would be excluded during project copying in MembersDependentService Begin of the insertion
>
>End of the insertion Begin of the deletion

End of the deletion * Add validation to prevent assigning template roles to non-template projects Begin of the insertion
>
>
>End of the insertion Begin of the deletion


End of the deletion **Pros:** Begin of the insertion
>
>End of the insertion Begin of the deletion

End of the deletion * A role is easily identifiable as templated, so you could show it in all global and project views Begin of the insertion
>
>End of the insertion Begin of the deletion

End of the deletion * Implementation and contracting should be simple for the Role creation service and the member creation service Begin of the insertion
>
>
>End of the insertion Begin of the deletion


End of the deletion **Cons:** Begin of the insertion
>
>End of the insertion Begin of the deletion

End of the deletion * Needs admins to set this up, less flexibility in each template Begin of the insertion
>
>End of the insertion Begin of the deletion

End of the deletion * I could see this lead to creating duplicate roles (e.g., &quot;Editor&quot; and &quot;Template Editor&quot;) with same permissions, that are hard to understand. Begin of the insertion
>
>
>End of the insertion Begin of the deletion


End of the deletion ##### Option 2: Global setting for roles excluded from template copy Begin of the insertion
>
>End of the insertion Begin of the deletion

End of the deletion <br> Begin of the insertion
>
>End of the insertion Begin of the deletion

End of the deletion * Add a global setting like template\_excluded\_role\_ids (array of ints) in Settings::Definition Begin of the insertion
>
>End of the insertion Begin of the deletion

End of the deletion * During copy, filter out roles whose IDs are in this list Begin of the insertion
>
>
>End of the insertion Begin of the deletion


End of the deletion **Pros:** Begin of the insertion
>
>End of the insertion Begin of the deletion

End of the deletion * Easiest to implement, as this is just applied on template copy Begin of the insertion
>
>End of the insertion Begin of the deletion

End of the deletion * Single place to manage this behavior Begin of the insertion
>
>End of the insertion Begin of the deletion

End of the deletion * Works with existing role structure Begin of the insertion
>
>
>End of the insertion Begin of the deletion


End of the deletion **Cons:** Begin of the insertion
>
>End of the insertion Begin of the deletion

End of the deletion * Hard for project admins to find out which roles are affected Begin of the insertion
>
>End of the insertion Begin of the deletion

End of the deletion * Need an admin to change this Begin of the insertion
>
> End of the insertion Begin of the deletion

End of the deletion <br> Begin of the insertion
>
>
>End of the insertion Begin of the deletion


End of the deletion ##### Option 3: Per-template setting for Begin of the deletion excluded roles

<br>

* Add a store\_attribute :settings, :excluded\_role\_ids\_on\_copy, :array to Project (for templates only)

* During copy in MembersDependentService, check if the source project has this setting and filter accordingly


**Pros:**

* Most flexible, each template can have its own excluded roles

* Doesn&#39;t require changes and migrations to roles


**Cons:**

* You need to configure it per template

* Same role can be copied from one template but not another, which might be confusing


<br>

##### Option 4: Per-template setting forEnd of the deletion included/excluded members Begin of the insertion
>
>End of the insertion Begin of the deletion

End of the deletion * Select users or groups in the template that you want to include or exclude Begin of the insertion
>End of the insertion