From 0a867c045985c0180c016a4df42773cfe4b45d7e Mon Sep 17 00:00:00 2001 From: Kari Lintulaakso Date: Thu, 5 Jun 2025 12:02:18 +0300 Subject: [PATCH] Slight modifications to the User Rights document (#844) --- documentation/user_rights.md | 136 +++++++++++++++-------------------- 1 file changed, 59 insertions(+), 77 deletions(-) diff --git a/documentation/user_rights.md b/documentation/user_rights.md index 675c7916..70101a5c 100644 --- a/documentation/user_rights.md +++ b/documentation/user_rights.md @@ -2,8 +2,7 @@ This document shows what each user role can and cannot do. -There are 7 different user roles: - +Previously, there were 7 different user roles: - Admin (su) - EditUnrestricted (eu) - EditRestricted (er) @@ -12,37 +11,36 @@ There are 7 different user roles: - NowOffice (no) - ReadOnly (ro) -Users that have not logged in have the **ReadOnly** role. +In the new UI platform, there are 4 user roles: +- Admin (su) +- EditUnrestricted (eu) +- EditRestricted (er, pl, plp, no) +- ReadOnly (ro) -The Project, ProjectPrivate and NowOffice roles exist in the code but are currently not used. They don't exist at all in frontend, and in backend they are only used when assigning roles to test users. The **EditRestricted** role is also only used in the frontend to show/hide editing buttons, the backend does not use the role in any way. +Users who have not logged in have the **ReadOnly** role. + +The Project, ProjectPrivate, and NowOffice roles exist in the old code but are currently not used. They don't exist at all in the frontend, and in the backend they are only used when assigning roles to test users. +The **EditRestricted** role is also only used in the frontend to show/hide editing buttons, the backend does not use the role in any way. ## Locality -Any user can get a list of localities. +- Any user can obtain a list of localities (private localities are an exception). +- Any user can view the details of a locality (private localities are an exception). +- Creating or updating a locality requires the **Admin**, **EditUnrestricted**, or **EditRestricted** roles. +- Deleting a locality requires the **Admin** or **EditUnrestricted** roles. -Any user can view the details of a locality. - -Creating or updating a locality requires the **Admin** or **EditUnrestricted** roles. - -Deleting a locality requires the **Admin** or **EditUnrestricted** roles. - -NOTE: Users with the **EditRestricted** role should only be able to create or update localities which are in the same project with the user. Otherwise they have reading rights only. +NOTE: Users with the **EditRestricted** role should only be able to create or update localities which are in the same project as the user. Otherwise, they have reading rights only. Current behaviour: - - Users with the **EditRestricted** role can access the edit view in **their own** localities, but sending the PUT request to the backend fails because the role doesn't have permissions. ## Species -Any user can get a list of species. - -Any user can view the details of a species. - -Creating or updating a species requires the **Admin** or **EditUnrestricted** roles. - -Deleting a species requires the **Admin** or **EditUnrestricted** roles. - -NOTE: Users with the **EditRestricted** role should be able to create and update species. This is currently not possible. +- Any user can get a list of species. +- Any user can view the details of a species. +- Creating or updating a species (and synonyms) requires the **Admin**, **EditUnrestricted**, or **EditRestricted** roles. +- Deleting a species requires the **Admin** or **EditUnrestricted** roles. +- Deleting a species synonym requires the **Admin**, **EditUnrestricted**, or **EditRestricted** roles. Current behaviour: @@ -50,103 +48,87 @@ Current behaviour: ## References -Any user can get a list of references. - -Any user can get a list of reference types. - -Any user can view the details of a reference. - -Creating or updating a reference requires the **Admin** or **EditUnrestricted** roles. - -Deleting a reference requires the **Admin** role. - -NOTE: Users with the **EditRestricted** role should not be able to read references. +- Any user can get a list of References. +- Any user can get a list of Reference types. +- Any user can view the details of a Reference. +- Creating or updating a Reference requires the **Admin**, **EditUnrestricted**, or **EditRestricted** roles. +- Deleting a Reference requires the **Admin** role. ## Time Unit -Any user can get a list of time units. - -Any user can view the details of a time unit. - -Any user can get a list of sequences. - -Creating or updating a time unit requires the **Admin** or **EditUnrestricted** roles. - -Deleting a time unit requires the **Admin** or **EditUnrestricted** roles. +- Any user can get a list of Time Units. +- Any user can view the details of a Time Unit. +- Creating or updating a Time Unit requires the **Admin** or **EditUnrestricted** roles. +- Deleting a Time Unit requires the **Admin** or **EditUnrestricted** roles. ## Time Bound -Getting a list of time bounds requires the **Admin** or **EditUnrestricted** roles. - -Viewing the details of a time bound requires the **Admin** or **EditUnrestricted** roles. - -Creating or updating a time bound requires the **Admin** or **EditUnrestricted** roles. - -Deleting a time bound requires the **Admin** or **EditUnrestricted** roles. - -NOTE: Users with the **EditRestricted** role should be able to get a list of time bounds and view their details, currently they are not allowed to. +- Any user can get a list of Time Bounds. +- Any user can view the details of a Time Bound. +- Creating or updating a Time Bound requires the **Admin** or **EditUnrestricted** roles. +- Deleting a Time Bound requires the **Admin** or **EditUnrestricted** roles. ## Region -Viewing a list of all regions requires the **Admin** role. - -Viewing the details of a region requires the **Admin** role. - -Creating or updating a region requires the **Admin** role. - -Deleting a region requires the **Admin** role. +- Viewing a list of all Regions requires the **Admin** role. +- Viewing the details of a Region requires the **Admin** role. +- Creating or updating a Region requires the **Admin** role. +- Deleting a Region requires the **Admin** role. ## Person -Getting a list of every person requires the **Admin** role. - -Any user can get their own information using their id, but cannot view other people's information (unless they have the **Admin** role) +- Viewing a list of every person requires the **Admin** role. +- Any user can get their information using their ID, but cannot view other people's information (unless they have the **Admin** role) ## Project -Any user can get a list of projects. - -Viewing the details of a project requires the **Admin** role. +- Any user can get a list of Projects. +- Viewing project details requires the **Admin** role. +- Creating or updating a Project requires the **Admin** role. +- Deleting a Project requires the **Admin** role. ## Museum -Any user can get a list of museums. +- Any user can get a list of museums. +- Any user can view the details of a Museum. +- Creating or updating a Museum requires the **Admin**, **EditUnrestricted**, or **EditRestricted** roles. ## Sedimentary Structure -Any user can get a list of sedimentary structures. +- Any user can get a list of sedimentary structures. ## Email -Sending an email requires the **Admin** role. +- Any user can send an email ## User Rights Table -NOTE: This is how user rights are implemented in the current version, it might change later. -| test | Locality | Species | References | Time Units | Time Bounds | Regions | Persons | Projects | Museums | Sedimentary Structures | Sending Email | +| User group | Locality | Species | References | Time Units | Time Bounds | Regions | Persons | Projects | Museums | Sedimentary Structures | Sending Email | | ---------------- | -------- | ------- | ---------- | ---------- | ----------- | ------- | ------- | -------- | ------- | ---------------------- | ------------- | -| Admin | ALL | ALL | ALL | ALL | ALL | ALL | ALL | ALL | ALL | ALL | ALL | -| EditUnRestricted | ALL | ALL | ALL | ALL | ALL | X | X\* | R\*\* | ALL | ALL | X | -| EditRestricted | R | R | R | R | X | X | X\* | R\*\* | R | R | X | -| ReadOnly | R | R | R | R | X | X | X\* | R\*\* | R | R | X | +| Admin | ALL | ALL | ALL | ALL | ALL | ALL | ALL | ALL | ALL | ALL | C | +| EditUnRestricted | ALL | ALL | ALL | ALL | ALL | X | X\*\*\* | R\*\* | ALL | ALL | C | +| EditRestricted | CRU | CRU | CRU | R | R | X | X\*\*\* | R\*\* | R | R | C | +| ReadOnly | R | R | R | R | R | X | X\*\*\* | R\*\* | R | R | C | C = Create R = Read -R = Update +U = Update -R = Delete +D = Delete X = No rights ALL = All rights -\* = Users can only get their own information. +\* = Requires a Project association \*\* = Any user can view a list of projects, but viewing the details of a project requires the **Admin** role. -Here's a matrix showing what the proper user rights should be. Not all of these are implemented yet. +\*\*\* = Users can only get their information. + +Below is a matrix showing the user rights. Not all of these are implemented yet. ![image](./images/user_rights_matrix.png)