To allow groups and users to be added to work packages, we can extend the existing `members` system to not only allow linking to a project, but also to Begin of the insertionan additional polymorphic relation called `entity`:End of the insertion Begin of the deletion a specific work package.End of the deletion

* Begin of the insertionWe already know that we will need to extend the system in the future, because other models will need a membership concept in the future as well (we already know that `Meeting`s will need it). So the syetemEnd of the insertion Begin of the deletion The relationEnd of the deletion should be Begin of the insertiondesigned inEnd of the insertion Begin of the deletion mutually exclusive (a membership can either be toEnd of the deletion a Begin of the insertionpolymorphic way.
End of the insertion Begin of the deletion project or to a work package, never both).
End of the deletion * Begin of the insertionTo quickly access what projects a user has access to,End of the insertion Begin of the deletion For thisEnd of the deletion we Begin of the insertionwant to keepEnd of the insertion Begin of the deletion can either makeEnd of the deletion the Begin of the insertion`project_id` field in the membershipsEnd of the insertion Begin of the deletion relationship between membersEnd of the deletion and Begin of the insertion**always** fill it out ifEnd of the insertion Begin of the deletion project/work package into a polymorphic relationship. This would make `JOIN` queries more complicated, but would simplifyEnd of the deletion the Begin of the insertionmembership is somehow product related.End of the insertion Begin of the deletion modeling of the relationEnd of the deletion
* Begin of the insertion`project NULL`, `entity NULL` → usedEnd of the insertion Begin of the deletion Another option would be,End of the deletion to Begin of the insertionassign global roles with global permissions
* `projet NOT NULL`, `entity NULL` → usedEnd of the insertion Begin of the deletion add a `work_package_id` fieldEnd of the deletion to Begin of the insertionassign project roles with project scoped + entity based permissionsEnd of the insertion Begin of the deletion the `members` table, and then adding a CONSTRAINT in the database,End of the deletion that Begin of the insertionapplyEnd of the insertion Begin of the deletion prevents both columnsEnd of the deletion to Begin of the insertionall entities withinEnd of the insertion Begin of the deletion be filled. Additionally we can add a rails validation. The CONSTRAINT onEnd of the deletion the Begin of the insertionproject
* `project NOT NULL`, `entity NOT NULL` → usedEnd of the insertion Begin of the deletion DB level would be benefitial in my eyes, because we do write membership queries directlyEnd of the deletion to Begin of the insertionassign entity specific roles with entity based permissions (i.e. for a specific work package)
* `~~project NULL~~`~~,~~ `~~entity NOT NULL~~` → This case is currently unusedEnd of the insertion Begin of the deletion the DB,End of the deletion and Begin of the deletion thusEnd of the deletion we Begin of the insertionare not considering it for now.End of the insertion Begin of the deletion would need another security layer instead of only relying on AR:

```sqlEnd of the deletion
Begin of the deletion ALTER TABLE members
ADD CONSTRAINT either_member_of_work_package_or_project CHECK (num_nulls(work_package_id, project_id) >= 1);
```

End of the deletion * The Begin of the insertionpermission checks have to be adjusted:
* TheEnd of the insertion current Begin of the insertioncheck checks for aEnd of the insertion permission Begin of the deletion checking system only worksEnd of the deletion on Begin of the insertionthe project or globally. This checkEnd of the insertion Begin of the deletion `project` level. The `user.allowed_to?` methodEnd of the deletion needs to be Begin of the insertionadjustedEnd of the insertion Begin of the deletion extendedEnd of the deletion to Begin of the insertionalso check that the `entity` is NULL, otherwise giving access toEnd of the insertion Begin of the deletion allow passing inEnd of the deletion a Begin of the insertionsingle `entity`, will give access to the entireEnd of the insertion project Begin of the deletion or a work package. End of the deletion
* Begin of the insertionAlso,End of the insertion Begin of the deletion When a work package permission is requested,End of the deletion the Begin of the insertioncheckEnd of the insertion Begin of the deletion codeEnd of the deletion needs to Begin of the insertionbe extended that we can pass in an `entity` instead ofEnd of the insertion Begin of the deletion check ifEnd of the deletion the Begin of the deletion permission is granted either through theEnd of the deletion project Begin of the insertiontoEnd of the insertion Begin of the deletion or directly onEnd of the deletion the Begin of the insertioncheck method and for this. WhenEnd of the insertion Begin of the deletion work package. As work package permissions might elevateEnd of the deletion the Begin of the insertionentity is bound toEnd of the insertion Begin of the deletion users permissions onEnd of the deletion a Begin of the insertionproject (`respond_to?(:project_id)`),End of the insertion Begin of the deletion specific work package,End of the deletion we Begin of the insertionneedEnd of the insertion Begin of the deletion always haveEnd of the deletion to check Begin of the insertionfor permissions on theEnd of the insertion Begin of the deletion both paths.
* When aEnd of the deletion project Begin of the insertionitself **and** onEnd of the insertion Begin of the deletion is given,End of the deletion the Begin of the insertionspecific entity.
End of the insertion Begin of the deletion test should stay as it is right now.
End of the deletion * Begin of the insertionFor this, we need to implement entity specifc roles ##49493End of the insertion Begin of the deletion Copying a work package, or copying the entire project should ensure that all memberships are correctly copied overEnd of the deletion