Differences

This shows you the differences between two versions of the page.

--- pracro:acl [2011/04/11 08:38] – deva
+++ pracro:acl [2011/04/13 14:33] – deva
@@ Line 1: / Line 1: @@
 ======ACL======
+=====Server=====
+====Design1====
+Templates contain ACLs. The users and roles are defined in a config file.\\
 Template:
 <code xml>
 <?xml version='1.0' encoding='UTF-8'?>
-<template name="ref_forunders" version="1.0" title="Refraktiv kirurgi forundersøgelse" aclcommit="nurse,br">
+<template name="ref_forunders" version="1.0" title="Refraktiv kirurgi forundersøgelse" restrict="employee">
   <macro name="header" static="true"/>
-  <macro name="henvisning" aclread="all" aclwrite="all"/>
+  <macro name="henvisning"/>
   <header caption="Anamnese"/>
-  <macro name="allergier" requires="henvisning" aclread="all" aclwrite="doctor"/>
+  <macro name="allergier" requires="henvisning" restrict="doctor"/>
-  <macro name="medicin" requires="henvisning" compact="true" aclread="all" aclwrite="doctor,nurse,br"/>
+  <macro name="medicin" requires="henvisning" compact="true" restrict="doctor, nurse"/>
-  <macro name="alment" requires="henvisning" aclread="doctor" aclwrite="none"/>
+  <macro name="alment" requires="henvisning"/>
 </template>
 </code>
-aclXXXXX attributes contain lists of either userids and/or groupids. Currently: 'aclread', 'aclwrite' and 'aclcommit'.
-aclwrite and aclread can be connected with the template and is inherited to all the contained macros.
 Users and Groups:
 <code>
-# some config file
+# some config file in libconfig++ format
-user {
+roles = (
-  name = 'Birger Rundstok'
+          {id="doctor"},
-  userid = 'br'
+          {id="nurse"},
-  groups = {'doctor'}
+          {id="optician"},
-}
+          {id="employee"}
+        );
+users = (
+          {id="akf"; name="Anne Kaufmann Frederiksen"; roles=("doctor", "nurse","employee)},
+          {id="ua"; name="Ulla Andersen"; roles=("nurse", "employee")},
+          {id="jbo"; name="Jens Børge Olfgård"; roles=("optician", "employee")},
+          {id="vis"; name="Visitor"; roles=()}
+        );
+</code>
-group {
+====Design2====
-  name = 'doctor'
+No changes to template. ACLs are defined in config file, with 'realms' being templates and macros.\\
-  groups = {'afdj'}
+ACL file:
-}
+<code>Syntax: template | :macro | template:macro action { rolelist }</code>
+<code>
+ref_forunders write {"doctor"}
+:henvisning write {"nurse", "doctor"}
+ref_forunders:allergier write {"doctor"}
+</code>
-group {
+Users and roles can be defined as in //Design1//.
-  name = 'afdj'
-}
+=====Client=====
+The data received on the client must indicate what features that is to be enabled for the current user, without the client having to make an explicit user lookup.
+Example:
+<code>
+<?xml version='1.0' encoding='UTF-8'?>
+<template name="ref_forunders" version="1.0" title="Refraktiv kirurgi forundersøgelse"
+          features="nocommit">
+  <macro name="header" static="true"/>
+  <macro name="henvisning" restricted="true"/>
+  <macro name="allergier"/>
+</template>
 </code>
+Making the commit button disabled or invisible and the 'henvisning' disabled/locked.