Return a message when permission fails

[dynamic-entropy]

"Permission denied" is many times not enough and cryptic, when permission is very conditional, for e.g. perm_add_rule.
It would be nice to also display a reason.

[ericvaandering]

I don't know why this was marked "High" priority or even put into this quarter as something we will do. I'm going to move this to ideas since as far as I can tell that's all this is.

[dynamic-entropy]

Hello @ericvaandering ,
All the users of Auto approval do not get a direct answer as to why their rule did not get created.
Since User rules take away a good chuck of ops workload, we would like to do this feature with priority.
This was a result of my discussion with Dima. Thus ops wants to take this with priority.

[ericvaandering]

That's fine. When you have something that's more, we can reassess where to put it in the project.

[dynamic-entropy]

More what?
Yes, we can reassess this later, but we should try to do it sooner than later. It has been on hold for about 8 months now. I have been able to give some pointers to people in JIRA tickets whenever they ask for answers, but it would be good if the clients could provide them hints by themselves.

[dynamic-entropy]

Upstream issue: rucio/rucio#6580

[dynamic-entropy]

This is not done. It requires one to change policy package to return back messages based on which policy caused a permission denial.

[haozturk]

This isn't only related to Auto Approval, but all rule creations and it'd be really helpful to better error messages. See #867