# User Rights

This document shows what each user role can and cannot do.

Previously, there were 7 different user roles:
- Admin (su)
- EditUnrestricted (eu)
- EditRestricted (er)
- Project (pl)
- ProjectPrivate (plp)
- NowOffice (no)
- ReadOnly (ro)

In the new UI platform, there are 4 user roles:
- Admin (su)
- EditUnrestricted (eu)
- EditRestricted (er, pl, plp, no)
- ReadOnly (ro)

Users who have not logged in have the **ReadOnly** role.

The Project, ProjectPrivate, and NowOffice roles exist in the old code but are currently not used. They don't exist at all in the frontend, and in the backend they are only used when assigning roles to test users.
The **EditRestricted** role is enforced in the backend for specific write operations (for example, locality writes are limited to the user's projects).

## Locality

- Any user can obtain a list of localities (private localities are an exception).
- Any user can view the details of a locality (private localities are an exception).
- Creating or updating a locality requires the **Admin**, **EditUnrestricted**, or **EditRestricted** roles.
- Deleting a locality requires the **Admin** or **EditUnrestricted** roles.

NOTE: Users with the **EditRestricted** role can only create or update localities that belong to the same project as the user. Otherwise, they have reading rights only.
When creating a new locality, EditRestricted users can only select projects where they are a member.
Users with the **EditUnrestricted** role are not limited by project membership when creating or updating localities.

## Species

- Any user can get a list of species.
- Any user can view the details of a species.
- Creating or updating a species (and synonyms) requires the **Admin**, **EditUnrestricted**, or **EditRestricted** roles.
- Deleting a species requires the **Admin** or **EditUnrestricted** roles.
- Deleting a species synonym requires the **Admin**, **EditUnrestricted**, or **EditRestricted** roles.
- Merging species requires the **Admin** role (via `/admin/species-merge`).

## References

- Any user can get a list of References.
- Any user can get a list of Reference types.
- Any user can view the details of a Reference.
- Creating or updating a Reference requires the **Admin**, **EditUnrestricted**, or **EditRestricted** roles.
- Deleting a Reference requires the **Admin** role.

## Time Unit

- Any user can get a list of Time Units.
- Any user can view the details of a Time Unit.
- Creating or updating a Time Unit requires the **Admin** or **EditUnrestricted** roles.
- Deleting a Time Unit requires the **Admin** or **EditUnrestricted** roles.

## Time Bound

- Any user can get a list of Time Bounds.
- Any user can view the details of a Time Bound.
- Creating or updating a Time Bound requires the **Admin** or **EditUnrestricted** roles.
- Deleting a Time Bound requires the **Admin** or **EditUnrestricted** roles.

## Region

- Viewing a list of all Regions requires the **Admin** role.
- Viewing the details of a Region requires the **Admin** role.
- Creating or updating a Region requires the **Admin** role.
- Deleting a Region requires the **Admin** role.

## Person

- Viewing a list of every person requires the **Admin** role.
- Any user can get their information using their ID, but cannot view other people's information (unless they have the **Admin** role)

## Project

- Any user can get a list of Projects.
- Viewing project details requires the **Admin** role.
- Creating or updating a Project requires the **Admin** role.
- Deleting a Project requires the **Admin** role.

## Museum

- Any user can get a list of museums.
- Any user can view the details of a Museum.
- Creating or updating a Museum requires the **Admin**, **EditUnrestricted**, or **EditRestricted** roles.

## Sedimentary Structure

- Any user can get a list of sedimentary structures.

## Email

- Any user can send an email

## User Rights Table


| User group       | Locality | Species | References | Time Units | Time Bounds | Regions | Persons | Projects | Museums | Sedimentary Structures | Sending Email |
| ---------------- | -------- | ------- | ---------- | ---------- | ----------- | ------- | ------- | -------- | ------- | ---------------------- | ------------- |
| Admin            | ALL      | ALL     | ALL        | ALL        | ALL         | ALL     | ALL     | ALL      | ALL     | ALL                    | C             |
| EditUnrestricted | ALL      | ALL     | ALL        | ALL        | ALL         | X       | X\*\*\* | R\*\*    | ALL     | ALL                    | C             |
| EditRestricted   | CRU      | CRU     | CRU        | R          | R           | X       | X\*\*\* | R\*\*    | CRU     | R                      | C             |
| ReadOnly         | R        | R       | R          | R          | R           | X       | X\*\*\* | R\*\*    | R       | R                      | C             |

C = Create

R = Read

U = Update

D = Delete

X = No rights

ALL = All rights

\* = Requires a Project association

\*\* = Any user can view a list of projects, but viewing the details of a project requires the **Admin** role.

\*\*\* = Users can only get their information.

Below is a matrix showing the user rights. Not all of these are implemented yet.

![image](./images/user_rights_matrix.png)