User Roles and Privileges - Revision history

Drn@ecs.soton.ac.uk at 17:23, 15 February 2024

2024-02-15T17:23:38Z

Libjlrs at 08:57, 14 December 2022

2022-12-14T08:57:03Z

Libjlrs at 08:51, 14 December 2022

2022-12-14T08:51:34Z

Libjlrs: Additional see-also link

2022-12-14T08:50:56Z

Additional see-also link

Drn@ecs.soton.ac.uk: /* Anatomy of a privilege */

2022-08-31T22:36:05Z

‎Anatomy of a privilege

Drn@ecs.soton.ac.uk: /* Anatomy of a privilege */

2022-08-31T22:33:37Z

‎Anatomy of a privilege

Drn@ecs.soton.ac.uk: Added guidance about the anatomy of a privilege.

2022-08-31T22:33:01Z

Added guidance about the anatomy of a privilege.

Drn@ecs.soton.ac.uk: Added manual stuff from User_roles.pl

2022-08-30T16:25:36Z

Added manual stuff from User_roles.pl

Drn@ecs.soton.ac.uk: Added link to user_roles.pl

2022-08-23T15:53:08Z

Added link to user_roles.pl

Drn@ecs.soton.ac.uk: Added links to glossary.

2022-08-04T11:53:27Z

Added links to glossary.

← Older revision		Revision as of 17:23, 15 February 2024
Line 90:		Line 90:

	There is no need for users to log in again following a privilege change, eprints will pick it up automatically.		There is no need for users to log in again following a privilege change, eprints will pick it up automatically.
		+
		+	== STAFF_ONLY ==
		+	Within a workflow a conditional statement can be used to restrict access like the example XML below:
		+	<epc:if test="$STAFF_ONLY = 'TRUE'">
		+	<component collapse="yes"><field ref="succeeds"/></component>
		+	</epc:if>
		+	Here "staff" is intended, in general, to mean repository staff (e.g. [[EPrints_Glossary#Repository admin\|repository admins]] and [[EPrints_Glossary#Editor\|editors]]) not any member of staff at the organisation who runs the EPrints repository. However, who can edit the values for field in the markup above is a little more complicated than that. It means any user who has the <code>eprint/edit:editor</code> (or possibly <code>user</code> or other type of data object) privilege, assuming that the specific eprint is within their editorial scope, if that is set for a user. Therefore, typically this means all repository admins and some if not all editors are covered by "STAFF_ONLY". It could also cover a regular user, if they have had the value <code>+eprint/edit:editor</code> set under their roles in their profile or if this privilege. It could also apply to other user types if this privilege is set for a particular user type or within a role that thus user type has (see [[User roles.pl\|user_roles.pl]]).
		+
		+	Instead (or as well as) using <code>$STAFF_ONLY</code>, for fields in the eprint workflow <code>$STAFF_ONLY_LOCAL</code> can be used. Whether this value is TRUE or FALSE is determined by what the the callback function defined in <code>$c->{STAFF_ONLY_LOCAL_callback}</code> returns. Assuming it is defined, which by default it is not. Below is an example of a callback function that defines staff as only the user with username: <tt>joe.bloggs</tt>:
		+
		+	$c->{STAFF_ONLY_LOCAL_callback} = sub {
		+
		+	my ( $eprint, $user, $permission ) = @_;
		+
		+	return $user->get_value( "username" ) eq "joe.bloggs";
		+	};
		+
		+	As well as using attributes or the user to determine access you can also use attributes of the eprint record being edited. <code>$permission</code> determines the type of permission. In the case of the eprint workflow for editing and eprint this is: <tt>write</tt>. Presently the EPrints codebase does not call this function with any other type of permission.

	== See Also ==		== See Also ==

← Older revision		Revision as of 08:57, 14 December 2022
Line 1:		Line 1:
		+	[[Category:User Roles]]
	This page is intended to provide a useful guide on how [[EPrints Glossary#User role\|user roles]] and [[EPrints Glossary#User privilege\|privileges]] work within EPrints repository software, expanding on the information already available at [[user_roles.pl]].		This page is intended to provide a useful guide on how [[EPrints Glossary#User role\|user roles]] and [[EPrints Glossary#User privilege\|privileges]] work within EPrints repository software, expanding on the information already available at [[user_roles.pl]].

@@ Line 94: / Line 94: @@
 * [[User_roles.pl|user_roles.pl]] - Describe the configuration file and how it may be edited/extended to modify/add new roles and privileges.
 * [[How to make a Screen for the Admin Section#Making the page appear|Screen plugin visibility]] - Example of making a new Screen Plugin appear using roles.
 [[Category:Manual]]

@@ Line 93: / Line 93: @@
 * [[Listings of User Roles and Privileges]] - A reference to role and privileges and what they allow a user to do.
 * [[User_roles.pl|user_roles.pl]] - Describe the configuration file and how it may be edited/extended to modify/add new roles and privileges.
+* [[How to make a Screen for the Admin Section#Making the page appear|Screen plugin visibility]] - Example of making a new Screen Plugin appear using roles.
 [[Category:Manual]]

@@ Line 30: / Line 30: @@
 * eprint/buffer/export
 eprint and user data objects can also have an additional modifier to restrict the context in which the privilege permits access:
-; eprint/inbox/view:owner
+; eprint/inbox/view&#58;owner
 : A user can only view eprints that they own in the user workarea.
-; eprint/buffer/edit:editor
+; eprint/buffer/edit&#58;editor
 : Only users with editorial scope for the eprint can edit it when it is in the review buffer
-; user/view:owner
+; user/view&#58;owner
 : A user can only view their own user profile.
 config privileges are typically use the specfic privilege they give access.  E.g.

@@ Line 19: / Line 19: @@
 Tip: Ensure the role is in {roles} not {user_roles}!
 == Creating a privilege ==
+There is no special step to creating a privilege, simply define it where you would like it tested for. Equally, there is no specified format for new privileges tying them to (for example) screens.  As a result the following are all valid:
 * "eprint/coindoi"
 * "eprint/coindoiffff"
 * "eprint/coindoi:editor"
 ==Assigning a role==

← Older revision		Revision as of 16:25, 30 August 2022
Line 1:		Line 1:
	This page is intended to provide a useful guide on how [[EPrints Glossary#User role\|user roles]] and [[EPrints Glossary#User privilege\|privileges]] work within EPrints repository software, expanding on the information already available at [[user_roles.pl]].		This page is intended to provide a useful guide on how [[EPrints Glossary#User role\|user roles]] and [[EPrints Glossary#User privilege\|privileges]] work within EPrints repository software, expanding on the information already available at [[user_roles.pl]].
		+
		+	A role in EPrints is made up of 1 or more privileges. Giving a user a role gives them all the privileges associated with that role. You can also give users additional privileges without giving them the full role.
		+
		+	==Creating a role==
		+	To create the role <code>approve-hat</code> you would do the following:
		+	<pre>
		+	$c->{roles}->{"approve-hat"} = [
		+	"eprint/buffer/view:editor",
		+	"eprint/buffer/summary:editor",
		+	"eprint/buffer/details:editor",
		+	"eprint/buffer/move_archive:editor",
		+	];
		+	</pre>
		+	The privileges listed above means the users given the <code>approve-hat</code> role can see the View, Summary, Details and Move to archive screen as an editor. Note because they cannot edit items [[Standard names \|in the buffer]] they can't correct any mistakes they find. However they do have the power to move items to the archive. This means the <code>approve-hat</code> allows a user to see the metadata of an item and if they think it is correct move it to the archive. They cannot return it to the user or edit the metadata themselves.
		+
		+	The quoting around the role name approve-hat is required, eprints will generate an error if the text is simply {approve-hat}.
		+
		+
		+	Tip: Ensure the role is in {roles} not {user_roles}!
		+
		+	== Creating a privilege ==
		+
		+	There is no special step to creating a privilege, simply define it where you would like it tested for. Equally, there is no specified format for privileges tying them to (for example) screens.
		+
		+	As a result the following are all valid:
		+
		+	* "eprint/coindoi"
		+	* "eprint/coindoiffff"
		+	* "eprint/coindoi:editor"
		+
		+	==Assigning a role==
		+	Now that you have created a role you want to give that to class of users. To give every regular user of the repository the <code>approve-hat</code> you add it to the list of roles for the user.
		+
		+	<pre>
		+	$c->{user_roles}->{user} = [
		+	'general',
		+	'edit-own-record',
		+	'saved-searches',
		+	'set-password',
		+	'deposit',
		+	'change-email',
		+	'approve-hat',
		+	],
		+	</pre>
		+
		+	Rather than giving every user the role you can give it to individual users. Administer a users profile and add the name of the role to their list of additional roles.
		+
		+	[[File:Approve-hat.jpg]]
		+
		+	==Assigning a user privilege==
		+	You do not have to give a user a full role you can give them a privilege. The syntax is slightly different. Add the name of the privilege prefixed with a '+' to the list of roles. You can remove a privilege by prefixing it with a '-'.
		+
		+	<pre>
		+	$c->{user_roles}->{user} = [
		+	'general',
		+	'edit-own-record',
		+	'saved-searches',
		+	'set-password',
		+	'deposit',
		+	'change-email',
		+	'approve-hat',
		+	'+eprint/archive/edit:owner',
		+	],
		+	</pre>
		+
		+	You can also assign privileges to individual users through the web interface in the same way you can assign a role, remembering they will be listed as "roles". (remember the '+' or '-')
		+
		+	There is no need for users to log in again following a privilege change, eprints will pick it up automatically.

	== See Also ==		== See Also ==

← Older revision		Revision as of 11:53, 4 August 2022
Line 1:		Line 1:
−	This page is intended to provide a useful guide on how user roles and privileges work within EPrints repository software, expanding on the information already available at [[user_roles.pl]].	+	This page is intended to provide a useful guide on how [[EPrints Glossary#User role\|user roles]] and [[EPrints Glossary#User privilege\|privileges]] work within EPrints repository software, expanding on the information already available at [[user_roles.pl]].

	== See Also ==		== See Also ==