Access rights to documents and elements on the document cards
Task description
It is essential to ensure assignment of access rights to the document and its attributes for users taking into account the status of the document and the role of the user.
A document status is a document property that automatically changes as soon as a business process connected with the document is implemented.
A role is a complex of performed functions, authorities and responsibilities. In this context the role in the case is meant.
Guides
For statuses of documents and roles new guides must be created. They will be common to all document types and roles in cases.
Document statuses guide
This guide contains all available document statuses.
Field name | Field type | Description |
code | d:text | Status code. Used in calculation and must be written in English. |
name | d:mltext | Status name which is visible for the user |
description | d:mltext | Status description |
Roles guide
The guide holds all predetermined case’s roles.
Field name | Field type | Description |
code | d:text | Role code. Used in calculation and must be written in English |
name | d:mltext | Role name which is visible for the user |
description | d:mltext | Role description |
originalRole | association | Link between copied role and its guide’s original. Not shown to the user |
Roles in cases must be led to that type.
Binding roles to document types and kinds will be performed through case templates as soon as the user sets list of roles in the case template from the guide.
Before developing matrix of role rights, roles used in the matrix must be bootstrapped
Matrix of access rights for roles to the document in different statuses
An access rights matrix is a matrix, in which column titles roles are stated, in the headings of lines documents’ statuses are specified and at the intersection of the line and column rights are specified which are provided to a role in a document in a compliant status.
Status/Role | Document initiator | Approver | Confidential approver |
No status (before creating) | Editing | No access | No access |
Draft | Editing | No access | No access |
Deleted | Overview | No access | No access |
There can be several such matrices in the system: a global rights matrix, which is used when a separate rights matrix is not defined for a type and kind of a document, and a rights matrix for document type and kind which will override the global one. It will also be necessary to add the ability to define the rights matrix for documents, according to the values of their properties (attributes), for example, if the document has the "Secret" flag set.
Thus the matrix of access rights for roles to the document in different statuses will be described with the following attributes:
- Document type
- Document kind
- Set of document properties with specified values
Selection of the corresponding rights matrix for the document will be made as follows:
- All rights matrices are selected with a “Document Type” field value is coincided with a document type, if there are no such matrices, the global rights matrix is applied.
- In the selected list of rights matrices we choose all matrices with the “Document kind “ field value coincided with the document kind, if there are no matches then the rights matrix for a type is applied, if there is one, or the global rights matrix is used, if a matrix for this type without specifying particular type is missing.
- If there are multiple rights matrices for a kind, we choose among them those one with attributes values identical to documents’ attributes values. If such a matrix is absent, in this case we select the matrix for type or kind, or the global one, depending on whether there is a separate matrix for this type with no set attributes or there is another separate matrix for this type without specifying a certain document kind.
Access rights matrix of roles to request card attributes
By analogy with the matrix of access rights to the document, the matrix of access rights to TTTT attributes is presented in the following way:
Role | Initiator | |||||
Attribute/Document status | No status | Draft | Approved | Revision | Signing by a contractor ("paper" document flow) | Signed by a contractor |
Document kind | Editing | Editing | Overview | Editing | Overview | Overview |
Additional consulting services | Editing | Editing | Overview | Editing | Overview | Overview |
For an accurate implementation of this matrix, it is necessary that the model contains all the attributes to which rights will be assigned
For each type (and type) of the document, the matrix in the rows of which will be attributes of the type (type) of the document, and in the columns will be the pair [role, status]. In the matrix cells, at the intersection of the column and the row, the role is assigned to edit the attribute of the document in the specified status.
In Alfresco matrix can be presented as an entity of a type with the following fields:
- Alfresco document type
- Document type
- Document kind
- List of fields to be authorized to edit
Data for fields is taken from the document type in Alfresco and from all associated types through associations and aspects. It will be necessary to elaborate a storage structure as at our solution several tables attached to a contract and one must give access rights to their attributes, that is, a chain {property of document} - {property type | association type}} {type property} is obtained.
The Alfresco type, which will represent access rights, contains the following fields:
- Reference to a role (roles guide)
- Reference to a status (document statuses guide)
- Flag allowing attribute’s editing
When setting a matrix for editing rights of document’s attributes an administrator:
- Indicates for which type a rights matrix is being created (selects an Alfresco type);
- Chooses attributes to which rights will be assigned;
- Selects roles from the roles guide;
- Selects statuses from the statuses guide;
- Names for each role and status in the matrix which attribute from selected can be modified by a user from a role (implements in a checkbox form, by default the checkbox is off)
When rendering a form, you must determine in what role the user is currently in and select the rights matrix to attributes in accordance with the type and kind. If the user enters several roles, we take the most powerful right (i.e. if the A role can view, and the B role is able to edit, then we take rights from role B).
Preparation for filling-in of access rights of roles to documents
- A system administrator fills in a roles guide for a case and a statuses guide for a document. Thereafter he will have the opportunity to fill in the global matrix of role rights for the document in all statuses.
- When case templates for types and kinds are ready, the administrator can set access rights for these types, besides only those roles that are added from the role guide to the case will be selected to the rights matrix (local case roles will not be selected yet).
- In the same way, the administrator can set a separate rights matrix for documents of a certain type and kind, specifying additionally the document attributes and their values, if coincident with them this rights matrix will be applied to the copy of the document created on the basis of the case template.
Current implementation of the access rights verification
At the moment there are two mechanisms for verifying and assigning of access rights:
- Access rights for users entering a role of a case to a document (case) in a certain status.
- Access rights for users entering a role of a case to fields on a document card (case) in accordance with a current status of a case.
The assignment and modification of users' rights to the document (case) are fulfilled when the status of the document (case) changes. Verification of the user's rights to the fields on the document card (case) is made dynamically, when the card is being opened for editing (taking into account the role of the user and the current status of the case). If the user is entered in several case roles, the system will assign to the user the maximum access right from those defined for these roles.
Regulations of access to the document and editing its fields are determined in a matrix which is represented by a xml-document.
Matrix of access rights to the document
The present matrix is described in a form of the next xml-document:
<?xml version="1.0" encoding="UTF-8"?>
<matrix>
<type name="workspace://SpacesStore/unilever-cat-doctype-attorney"/>
<kind name=""/>
<matrix>
<columns>
<column id="initiator" value="initiator"/>
<column id="owner" value="owner"/>
<column id="archivist" value="archivist"/>
<column id="lawyer" value="lawyer"/>
</columns>
<rows>
<row id="unilever-draft" value="unilever-draft"/>
<row id="unilever-rejected" value="unilever-rejected"/>
</rows>
<cells>
<cell rowId="unilever-draft" columnId="initiator" value="Write"/>
<cell rowId="unilever-draft" columnId="owner" value=""/>
<cell rowId="unilever-draft" columnId="archivist" value=""/>
<cell rowId="unilever-draft" columnId="lawyer" value=""/>
<cell rowId="unilever-rejected" columnId="initiator" value="Read"/>
<cell rowId="unilever-rejected" columnId="owner" value="Read"/>
<cell rowId="unilever-rejected" columnId="archivist" value="Write"/>
<cell rowId="unilever-rejected" columnId="lawyer" value="Read">
<conditionsGroup operator="AND">
<condition prop="att:attorneyType" operation="EQUALS" value="standart"/>
</conditionsGroup>
</cell>
<cell rowId="unilever-rejected" columnId="lawyer" value="Write">
<conditionsGroup operator="OR">
<condition prop="att:attorneyType" operation="EQUALS" value="non-standart"/>
<condition prop="att:attorneyType" operation="EQUALS" value="notary"/>
</conditionsGroup>
</cell>
</cells>
</matrix>
</matrix>
This XML document describes the access rights matrix to the document for the case roles the initiator, owner, archivist, and lawyer for the unilever-draft and unilever-rejected statuses. Three blocks describing can be distinguished in the document:
- Definition of the type and kind of the document to which this rights matrix to the document is applied
- Blocks for describing the columns and rows of the matrix ( headings of columns (roles) and rows (status))
- The block describing rights to the document for the role in the corresponding document status(matrix cells)
The values for type and kind are taken from the types and kinds of ECOS and conform to the nodeRef of the corresponding type and kind.
The description of the <column>column and the <row>row of the matrix consists of an identifier and a reference to a role or a status. The value of the icaseRole:varName property of the corresponding role from the "Case Roles" guide acts as a reference to the role, and the value of the cm:name property of the corresponding status from the "Statuses of the Case" guide constitutes a reference to the status. The identifier of the column and the row is further used in the description of the matrix cell, which is located at the intersection of the column and the row in the matrix.
The description of the matrix cells represents references to the row identifier (rowId), to the column identifier (columnId), and the value (value) of the access rights to the Read / Write document.
In the description of the matrix cell you can set conditions under which the specified access right will be given to a role, when the document is in the relevant status. For that purpose nested conditionsGroup tags are used. conditionsGroup can contain other conditionsGroup and condition. conditionsGroup is a cover over the conditions in which the nesting of conditions is defined, i.e. in the “operator” attribute an operation is set that will be applied to all nested conditions or condition groups. Legitimate values are OR or AND. Conditions (condition) constitute conditions on document (case) properties; that is, a comparison of the value of the specified property with the value specified in the condition of the access matrix cell. Currently supported properties are (can be used in conditions): string, numeric and boolean properties of the document. For string properties, the following statements can be employed: EMPTY, EQUALS, NOT_EQUALS. For Boolean properties, EQUALS, NOT_EQUALS, EMPTY operations are supported. And for numeric properties, EMPTY, EQUALS, NOT_EQUALS, LESS_THAN, LESS_OR_EQUALS_THAN, MORE_THAN, MORE_OR_EQUALS_THAN operations are supported.
For each cell, one nested group of conditionsGroup must be specified in which all nested conditions are being defined.
Matrix of access rights to documents attributes
The given matrix is described in the following xml-document:
<?xml version="1.0" encoding="UTF-8"?>
<matrix>
<type name="workspace://SpacesStore/unilever-cat-doctype-attorney"/>
<kind name=""/>
<!-- unilever-approval -->
<matrix>
<columns>
<!-- Initiator - Draft -->
<column id="initiator-unilever-draft" roleId="initiator" statusId="unilever-draft"/>
<!-- Initiator - Reworking -->
<column id="initiator-unilever-reworking" roleId="initiator" statusId="unilever-reworking"/>
<!-- Initiator - Repealed -->
<column id="initiator-unilever-repealed" roleId="initiator" statusId="unilever-repealed"/>
<!-- Owner - On approval -->
<column id="owner-unilever-approval" roleId="owner" statusId="unilever-approval"/>
<column id="owner-unilever-on-approval-lawyer" roleId="owner" statusId="unilever-on-approval-lawyer"/>
<column id="owner-unilever-on-approval-archivist" roleId="owner" statusId="unilever-on-approval-archivist"/>
<column id="owner-unilever-additional-approval" roleId="owner" statusId="unilever-additional-approval"/>
<!-- Owner - Repealed -->
<column id="owner-unilever-repealed" roleId="owner" statusId="unilever-repealed"/>
<!-- Confirmer - On approval -->
<column id="additional-confirmer-unilever-approval" roleId="additional-confirmer"
statusId="unilever-approval"/>
<column id="additional-confirmer-unilever-on-approval-lawyer" roleId="additional-confirmer"
statusId="unilever-on-approval-lawyer"/>
<column id="additional-confirmer-unilever-on-approval-archivist" roleId="additional-confirmer"
statusId="unilever-on-approval-archivist"/>
<column id="additional-confirmer-unilever-additional-approval" roleId="additional-confirmer"
statusId="unilever-additional-approval"/>
<!-- АAuditor - On approval -->
<column id="unilever-auditor-unilever-approval" roleId="unilever-auditor" statusId="unilever-approval"/>
<column id="unilever-auditor-unilever-on-approval-lawyer" roleId="unilever-auditor"
statusId="unilever-on-approval-lawyer"/>
<column id="unilever-auditor-unilever-on-approval-archivist" roleId="unilever-auditor"
statusId="unilever-on-approval-archivist"/>
<column id="unilever-auditor-unilever-additional-approval" roleId="unilever-auditor"
statusId="unilever-additional-approval"/>
<!-- Signer- On signing -->
<column id="unilever-signer-unilever-signing" roleId="signer" statusId="unilever-signing"/>
<!-- Lawyer - Approved by a owner -->
<column id="lawyer-unilever-approval-lawyer-owner" roleId="lawyer"
statusId="unilever-approval-lawyer-owner"/>
<column id="lawyer-unilever-approval-archivist-owner" roleId="lawyer"
statusId="unilever-approval-archivist-owner"/>
<!-- Lawyer- On approval -->
<column id="lawyer-unilever-approval" roleId="lawyer" statusId="unilever-approval"/>
<column id="lawyer-unilever-on-approval-lawyer" roleId="lawyer" statusId="unilever-on-approval-lawyer"/>
<column id="lawyer-unilever-on-approval-archivist" roleId="lawyer"
statusId="unilever-on-approval-archivist"/>
<column id="lawyer-unilever-additional-approval" roleId="lawyer" statusId="unilever-additional-approval"/>
<!-- Lawyer - Active -->
<column id="lawyer-unilever-active" roleId="lawyer" statusId="unilever-active"/>
<!-- Lawyer - Prepared -->
<column id="lawyer-unilever-prepared" roleId="lawyer" statusId="unilever-prepared"/>
<column id="lawyer-unilever-prepared-archive" roleId="lawyer" statusId="unilever-prepared-archive"/>
<!-- Archivist - Approved by an owner -->
<column id="archivist-unilever-lawyer-approved-owner" roleId="archivist"
statusId="unilever-approval-lawyer-owner"/>
<column id="archivist-unilever-archivist-approved-owner" roleId="archivist"
statusId="unilever-approval-archivist-owner"/>
<!-- Archivist - On signing -->
<column id="archivist-unilever-signing" roleId="archivist" statusId="unilever-signing"/>
<!-- Archivist - Prepared -->
<column id="archivist-unilever-prepared" roleId="archivist" statusId="unilever-prepared"/>
<!-- Archivist - Active -->
<column id="archivist-unilever-active" roleId="archivist" statusId="unilever-active"/>
<!-- Archivist - Signed -->
<column id="archivist-unilever-signed" roleId="archivist" statusId="unilever-signed"/>
<!-- Archivist - Cancelled -->
<column id="archivist-unilever-cancelled" roleId="archivist" statusId="unilever-cancelled"/>
<!-- Archivist - On approval -->
<column id="archivist-unilever-approval" roleId="archivist" statusId="unilever-approval"/>
<column id="archivist-unilever-on-approval-lawyer" roleId="archivist"
statusId="unilever-on-approval-lawyer"/>
<column id="archivist-unilever-on-approval-archivist" roleId="archivist"
statusId="unilever-on-approval-archivist"/>
<column id="archivist-unilever-additional-approval" roleId="archivist"
statusId="unilever-additional-approval"/>
<!-- Archivist - Repealed -->
<column id="archivist-unilever-repealed" roleId="archivist" statusId="unilever-repealed"/>
<!-- Archivist - ejected -->
<column id="archivist-unilever-rejected" roleId="archivist" statusId="unilever-rejected"/>
<!-- Archivist- Closed -->
<column id="archivist-unilever-closed" roleId="archivist" statusId="unilever-closed"/>
</columns>
<rows>
<!-- Attorney type -->
<row id="att-attorneyType" type="urkk:attorneys" field="att:attorneyType"/>
<!-- Legal entity -->
<row id="udm-legalEntity" type="urkk:attorneys" field="udm:legalEntity"/>
<!-- Start date since -->
<row id="att-startDate" type="urkk:attorneys" field="att:startDate"/>
</rows>
<cells>
<!-- Initiator - Draft -->
<cell rowId="att-attorneyType" columnId="initiator-unilever-draft" value="true"></cell>
<!-- Initiator - Reworking -->
<cell rowId="att-attorneyType" columnId="initiator-unilever-reworking" value="true"></cell>
<!-- Initiator - draft -->
<cell rowId="udm-legalEntity" columnId="initiator-unilever-draft" value="true"></cell>
<!-- Initiator - Reworking -->
<cell rowId="udm-legalEntity" columnId="initiator-unilever-reworking" value="true"></cell>
<!-- Initiator - Draft -->
<cell rowId="att-startDate" columnId="initiator-unilever-draft" value="true"></cell>
<!-- Initiator - Reworking -->
<cell rowId="att-startDate" columnId="initiator-unilever-reworking" value="true"></cell>
<!-- Owner - On approval -->
<cell rowId="att-startDate" columnId="owner-unilever-approval" value="true">
<!--<conditionsGroup operator="OR">-->
<!--<condition prop="att:attorneyType" operation="EQUALS" value="non-standart"/>-->
<!--<condition prop="att:attorneyType" operation="EQUALS" value="notary"/>-->
<!--</conditionsGroup>-->
</cell>
<cell rowId="att-startDate" columnId="owner-unilever-on-approval-lawyer" value="true">
<!--<conditionsGroup operator="OR">-->
<!--<condition prop="att:attorneyType" operation="EQUALS" value="non-standart"/>-->
<!--<condition prop="att:attorneyType" operation="EQUALS" value="notary"/>-->
<!--</conditionsGroup>-->
</cell>
<cell rowId="att-startDate" columnId="owner-unilever-on-approval-archivist" value="true">
<!--<conditionsGroup operator="OR">-->
<!--<condition prop="att:attorneyType" operation="EQUALS" value="non-standart"/>-->
<!--<condition prop="att:attorneyType" operation="EQUALS" value="notary"/>-->
<!--</conditionsGroup>-->
</cell>
<cell rowId="att-startDate" columnId="owner-unilever-additional-approval" value="true">
<!--<conditionsGroup operator="OR">-->
<!--<condition prop="att:attorneyType" operation="EQUALS" value="non-standart"/>-->
<!--<condition prop="att:attorneyType" operation="EQUALS" value="notary"/>-->
<!--</conditionsGroup>-->
</cell>
<!-- Lawyer - Approved by an owner -->
<cell rowId="att-startDate" columnId="lawyer-unilever-approval-lawyer-owner" value="true">
<conditionsGroup operator="OR">
<condition prop="att:attorneyType" operation="EQUALS" value="non-standart"/>
<condition prop="att:attorneyType" operation="EQUALS" value="notary"/>
</conditionsGroup>
</cell>
<cell rowId="att-startDate" columnId="lawyer-unilever-approval-archivist-owner" value="true">
<conditionsGroup operator="OR">
<condition prop="att:attorneyType" operation="EQUALS" value="non-standart"/>
<condition prop="att:attorneyType" operation="EQUALS" value="notary"/>
</conditionsGroup>
</cell>
<!-- Lawyer - On approval -->
<cell rowId="att-startDate" columnId="lawyer-unilever-approval" value="true">
<conditionsGroup operator="OR">
<condition prop="att:attorneyType" operation="EQUALS" value="non-standart"/>
<condition prop="att:attorneyType" operation="EQUALS" value="notary"/>
</conditionsGroup>
</cell>
<cell rowId="att-startDate" columnId="lawyer-unilever-on-approval-lawyer" value="true">
<conditionsGroup operator="OR">
<condition prop="att:attorneyType" operation="EQUALS" value="non-standart"/>
<condition prop="att:attorneyType" operation="EQUALS" value="notary"/>
</conditionsGroup>
</cell>
<cell rowId="att-startDate" columnId="lawyer-unilever-on-approval-archivist" value="true">
<conditionsGroup operator="OR">
<condition prop="att:attorneyType" operation="EQUALS" value="non-standart"/>
<condition prop="att:attorneyType" operation="EQUALS" value="notary"/>
</conditionsGroup>
</cell>
<cell rowId="att-startDate" columnId="lawyer-unilever-additional-approval" value="true">
<conditionsGroup operator="OR">
<condition prop="att:attorneyType" operation="EQUALS" value="non-standart"/>
<condition prop="att:attorneyType" operation="EQUALS" value="notary"/>
</conditionsGroup>
</cell>
<!-- Archivist - On approval-->
<cell rowId="att-startDate" columnId="archivist-unilever-approval" value="true"></cell>
<cell rowId="att-startDate" columnId="archivist-unilever-approval" value="true"></cell>
<cell rowId="att-startDate" columnId="archivist-unilever-approval" value="true"></cell>
<cell rowId="att-startDate" columnId="archivist-unilever-approval" value="true"></cell>
<!-- Archivist - Approved by an owner -->
<cell rowId="att-startDate" columnId="archivist-unilever-lawyer-approved-owner" value="true"></cell>
<cell rowId="att-startDate" columnId="archivist-unilever-archivist-approved-owner" value="true"></cell>
</cells>
</matrix>
</matrix>
This matrix is almost identical to the rights matrix to the document. Unlike the previous matrix, here the references to the role (roleId) and to the status of the document (statusId) are indicated, a type (type) and a property name (field) from the Alfresco model are specified in the rows, type and field fields. For the rows and columns, identifiers are set as well, which are then used in the description of the matrix cells (cell). The value (value) of the matrix cell can be true / false, which is analogous to the fact that the role can edit this property on the form or not. To reduce the size of the matrix, those cells are specified (filled) for which it is indicated that the specified properties can be edited by a role. For cells, you can also specify conditions under which the user can edit the property on the form.
Rights to associations/child-associations attributes.
To add limitations on editing documents associations, you need to configure the matrix in the following way:
In the assocPermissions tag the associations are listed to which attribute editing rights will apply. When listing such attributes in rows, you need to add the assocId associations (from the assocPermissions list).
Behavior of the rights matrix:
- There is a document in which an association / daughter association has its own case with the rights matrix and:
- The rights in the matrix for this association are configured in the document, the rights matrix of the document "overlaps" the rights of the matrix of the association itself.
- Rights in the matrix for this association are not configured in the document, the rights matrix of the association are implemented.
There are child elements in the document. When editing a child element from a parent form, the logic from the first item is applied. If you edit the child element separately from the parent, while positive verification of the primary parent for the occurrence of a correctly configured matrix on the current association, the rights from the primary parent matrix are applied. Otherwise, the rights from the own rights matrix (if any) are applied.