Support nested teams with inherited access

Feature Discussion
1

We use Vikunja with several teams, and it would be useful to support nesting teams under other teams instead of managing every membership and project permission separately.

The idea is that a parent team could have one or more child teams, and members of those child teams would inherit the access granted to the parent team.

The behavior I have in mind is:

  • A team can contain child teams.
  • Members of a child team inherit project access from the parent team.
  • Direct permissions continue to work normally.
  • Circular team relationships are not allowed.
  • A child team can optionally have admin rights on the parent team.
  • Removing a team relationship removes only the inherited access and leaves direct permissions unchanged.
  • Nested teams can be managed from the existing team UI.

I already have a working implementation for this in a self-hosted environment, including backend/API changes, UI support, migrations, and tests. I wanted to check whether this approach fits Vikunja before opening a pull request.

Current implementation showing a child team added to a parent team, with the option to grant admin access:

image
image1277×841 35.1 KB

The current tested implementation is available here if anyone would like to review it:
feature/nested-teams branch

It is currently based on our existing v2.6-derived environment and has not yet been rebased onto the latest main. I can prepare it against current main before opening a pull request if the approach looks suitable.

2

Hey :waving_hand: thanks for the suggestion.

What makes this a useful feature? Are you just recreating your org chart in Vikunja?

3

Not really recreating the org chart. The main use case is permission management. We have multiple teams that need access to the same projects, and today the same users or teams have to be added repeatedly. With nested teams, we can grant access once to a parent team and let child teams inherit it, while still keeping direct permissions where needed. It makes access management much simpler as the number of teams grows.