Changes between Version 29 and Version 30 of BluePrintAuthorization

Timestamp:

06/19/10 17:03:50 (14 years ago)

Author:

Fran Boon

Comment:

--

BluePrintAuthorization

@@ -232 +232 @@
    * NB If doing this then the roles checks inside {{{shn_has_permission()}}} & {{{shn_accessible_fields()}}} should be modified to read this global value instead of more DAL queries (even cached)!
 
- * A Developer should be able to restrict access to records to just those within a certain '''GIS Location''' (e.g. Country or Region)
+ * A Developer should be able to restrict access to records to just those within a certain '''GIS Location''' (e.g. Country or Region):
   * Add a special role 'Geographic' which can be added to {{{writer_id}}} (& maybe {{{reader_id}}} although less use case for this)
    * Patch {{{shn_has_permission()}}} & maybe {{{shn_accessible_query()}}} to spot this special case &, if no other roles match, then do a lookup in another table (or deployment_settings dict)
 
- * A Developer should be able to restrict access to records to just those within a certain ''Organisation'''
+ * A Developer should be able to restrict access to records to just those within a certain '''Organisation''':
   * This could be all members of the Organisation or just the 'Focal Point'
   * Add a special role 'Organisation' which can be added to {{{writer_id}}} (& maybe {{{reader_id}}} although less use case for this)
    * Patch {{{shn_has_permission()}}} & maybe {{{shn_accessible_query()}}} to spot this special case &, if no other roles match, then do a lookup in another table (or deployment_settings dict)
 
- * A Developer should be able to restrict access to records to just those which the person created
+ * A Developer should be able to restrict access to records to just those which the person '''Created''':
   * Add a special role 'Creator' which can be added to {{{writer_id}}} (& maybe {{{reader_id}}} although less use case for this)
    * Patch {{{shn_has_permission()}}} & maybe {{{shn_accessible_query()}}} to spot this special case &, if no other roles match, then do a check between {{{auth.user.id}}} & {{{table.created_by}}}
+
+ * Ideally options which a user doesn't have permission for should be hidden from them.
+  * ~~Modules are hidden from Modules menu & front page~~
+  * ~~Action buttons in tables only show 'Details' for unauthenticated users, but 'Update'/'Delete' for authenticated ones~~
+   * ideally would distinguish per record if some records restricted (We already pull the data for the rows, so need to ensure SQL query includes relevant fields & that we act upon them)
+  * Controller menus should be adjusted (currently done manually => harder maintenance)
+  * Views should be adjusted (currently done manually => harder maintenance)
 
 === Specific Examples ===