RFC Removal of default permissions

[jirikuncar]

Proposal

Can we remove invenio_records.permissions module as it is not recommended for large repositories to store per record access rights in invenio-access?

cc @inveniosoftware/triagers

[tiborsimko]

Indeed, we may want to recommend to use the collection concept instead. Note that this is touching the forthcoming "Invenio 3 Beta Access" sprint on how the recommended access control may look like; hopefully uniformly across services. E.g. CDS started to experiment with an alternative approach to collections... CERNDocumentServer/cds-videos#160 (comment)

[nharraud]

@jirikuncar I understand the need to remove the permission per record as it would bloat the database. However having a permission for reading, updating, deleting, creating ALL records can be useful. That way it is possible to create custom admin roles.

@tiborsimko I would be interested to see the suggested designs for permissions. We started some time ago a specification document for the permissions in B2Share. I would like to see how well these designs match our needs.
The code I see in the mentioned PR looks like what we where doing for the CloudView search engine and it worked well for search filtering.

[nharraud]

Ok for removing the permissions from invenio-records. As there are different kind of records (ex: deposits), having generic records permissions does not make sense anymore.

[tiborsimko]

I'd be also in favour of decoupling permissions better... But let's see @lnielsen's original use case for including it here and @egabancho`s RFC inveniosoftware/invenio-access#70

[lnielsen]

I think we can remove it, but I would appreciate if you could test out #138 on Zenodo. Basically, install Zenodo with #138, and run the tests.

Just to ensure that there's no collateral damage from making this change.