Editing User Roles and Privileges (section)

== STAFF_ONLY ==
Within a workflow a conditional statement can be used to restrict access like the example XML below:
 <epc:if test="$STAFF_ONLY = 'TRUE'">
     <component collapse="yes"><field ref="succeeds"/></component>
 </epc:if>
Here "staff" is intended, in general, to mean repository staff (e.g. [[EPrints_Glossary#Repository admin|repository admins]] and [[EPrints_Glossary#Editor|editors]]) not any member of staff at the organisation who runs the EPrints repository.  However, who can edit the values for field in the markup above is a little more complicated than that.  It means any user who has the <code>eprint/edit:editor</code> (or possibly <code>user</code> or other type of data object) privilege, assuming that the specific eprint is within their editorial scope, if that is set for a user.  Therefore, typically this means all repository admins and some if not all editors are covered by "STAFF_ONLY".  It could also cover a regular user, if they have had the value <code>+eprint/edit:editor</code> set under their roles in their profile or if this privilege.  It could also apply to other user types if this privilege is set for a particular user type or within a role that thus user type has (see [[User roles.pl|user_roles.pl]]).

Instead (or as well as) using <code>$STAFF_ONLY</code>, for fields in the eprint workflow <code>$STAFF_ONLY_LOCAL</code> can be used.  Whether this value is TRUE or FALSE is determined by what the the callback function defined in <code>$c->{STAFF_ONLY_LOCAL_callback}</code> returns.  Assuming it is defined, which by default it is not.  Below is an example of a callback function that defines staff as only the user with username: <tt>joe.bloggs</tt>:

 $c->{STAFF_ONLY_LOCAL_callback} = sub {
 
     my ( $eprint, $user, $permission ) = @_;
 
     return $user->get_value( "username" ) eq "joe.bloggs";
 };

As well as using attributes or the user to determine access you can also use attributes of the eprint record being edited.  <code>$permission</code> determines the type of permission.  In the case of the eprint workflow for editing and eprint this is: <tt>write</tt>.  Presently the EPrints codebase does not call this function with any other type of permission.