diff --git a/services/settings/README.md b/services/settings/README.md index 6567231610..951b6b0375 100644 --- a/services/settings/README.md +++ b/services/settings/README.md @@ -83,3 +83,365 @@ The `OCIS_DEFAULT_LANGUAGE` setting impacts the `notification` and `userlog` ser * If `OCIS_DEFAULT_LANGUAGE` **is set**, the expected behavior is: * The `notification` and `userlog` services and the WebUI use `OCIS_DEFAULT_LANGUAGE` by default until a user sets another language in the WebUI via _Account -> Language_. * If a user sets another language in the WebUI in _Account -> Language_, the `notification` and `userlog` services and WebUI use the language defined by the user. If no translation is found, it falls back to `OCIS_DEFAULT_LANGUAGE` and then to English. + +## Custom Roles + +Is it possible to replace the default ocis roles (`admin`, `user`) with custom roles that contain custom permissions. One can set `SETTINGS_BUNDLES_PATH` to the path of a `json` file containing the new roles. + +Role Example: +```json +[ + { + "id": "38071a68-456a-4553-846a-fa67bf5596cc", // ID of the role. Use a random uuid + "name": "user-light", // Internal name of the role. + "type": "TYPE_ROLE", // Always use `TYPE_ROLE` + "extension": "ocis-roles", // Always use `ocis-roles` + "displayName": "User Light", // DisplayName of the role used in webui + "settings": [ + ], // Permissions attached to the role. See Details below. + "resource": { + "type": "TYPE_SYSTEM" // Always use `TYPE_SYSTEM` + } + } +] +``` + +Example Permission: +```json +{ + "id": "79e13b30-3e22-11eb-bc51-0b9f0bad9a58", // ID of the permission + "name": "Drives.Create", // Internal name of the permission + "displayName": "Create Space", // Display name of the permission + "description": "This permission allows creating new spaces.", // Description of the permission + "permissionValue": { + "operation": "OPERATION_READWRITE", // Operation of the permission + "constraint": "CONSTRAINT_ALL" // Constraint of the permission + }, + "resource": { + "type": "TYPE_SYSTEM" // Resource type of the permission + } +} +``` + +To create custom roles, copy the role example to a `json` file. Then change `id`, `name`, and `displayName` to your liking. Finally copy the desired permissions to the `settings` array of the role. +You can define multiple roles within one file, see example below. + +Example File: +```json +[ + { + "id": "38071a68-456a-4553-846a-fa67bf5596cc", + "name": "user-1-permission", + "type": "TYPE_ROLE", + "extension": "ocis-roles", + "displayName": "User with one permission only", + "settings": [ + { + "id": "7d81f103-0488-4853-bce5-98dcce36d649", + "name": "Language.ReadWrite", + "displayName": "Permission to read and set the language", + "permissionValue": { + "operation": "OPERATION_READWRITE", + "constraint": "CONSTRAINT_OWN" + }, + "resource": { + "type": "TYPE_SETTING", + "id": "aa8cfbe5-95d4-4f7e-a032-c3c01f5f062f" + } + } + ], + "resource": { + "type": "TYPE_SYSTEM" + } + }, + { + "id": "71881883-1768-46bd-a24d-a356a2afdf7f", + "name": "user-all-permissions", + "type": "TYPE_ROLE", + "extension": "ocis-roles", + "displayName": "User with all available permissions", + "settings": [ + { + "id": "8e587774-d929-4215-910b-a317b1e80f73", + "name": "Accounts.ReadWrite", + "displayName": "Account Management", + "description": "This permission gives full access to everything that is related to account management.", + "permissionValue": { + "operation": "OPERATION_READWRITE", + "constraint": "CONSTRAINT_ALL" + }, + "resource": { + "type": "TYPE_USER", + "id": "all" + } + }, + { + "id": "4e41363c-a058-40a5-aec8-958897511209", + "name": "AutoAcceptShares.ReadWriteDisabled", + "displayName": "enable/disable auto accept shares", + "permissionValue": { + "operation": "OPERATION_READWRITE", + "constraint": "CONSTRAINT_OWN" + }, + "resource": { + "type": "TYPE_SETTING", + "id": "ec3ed4a3-3946-4efc-8f9f-76d38b12d3a9" + } + }, + { + "id": "ed83fc10-1f54-4a9e-b5a7-fb517f5f3e01", + "name": "Logo.Write", + "displayName": "Change logo", + "description": "This permission permits to change the system logo.", + "permissionValue": { + "operation": "OPERATION_READWRITE", + "constraint": "CONSTRAINT_ALL" + }, + "resource": { + "type": "TYPE_SYSTEM" + } + }, + { + "id": "11516bbd-7157-49e1-b6ac-d00c820f980b", + "name": "PublicLink.Write", + "displayName": "Write publiclink", + "description": "This permission allows creating public links.", + "permissionValue": { + "operation": "OPERATION_WRITE", + "constraint": "CONSTRAINT_ALL" + }, + "resource": { + "type": "TYPE_SHARE" + } + }, + { + "id": "069c08b1-e31f-4799-9ed6-194b310e7244", + "name": "Shares.Write", + "displayName": "Write share", + "description": "This permission allows creating shares.", + "permissionValue": { + "operation": "OPERATION_WRITE", + "constraint": "CONSTRAINT_ALL" + }, + "resource": { + "type": "TYPE_SHARE" + } + }, + { + "id": "79e13b30-3e22-11eb-bc51-0b9f0bad9a58", + "name": "Drives.Create", + "displayName": "Create Space", + "description": "This permission allows creating new spaces.", + "permissionValue": { + "operation": "OPERATION_READWRITE", + "constraint": "CONSTRAINT_ALL" + }, + "resource": { + "type": "TYPE_SYSTEM" + } + }, + { + "id": "5de9fe0a-4bc5-4a47-b758-28f370caf169", + "name": "Drives.DeletePersonal", + "displayName": "Delete All Home Spaces", + "description": "This permission allows deleting home spaces.", + "permissionValue": { + "operation": "OPERATION_DELETE", + "constraint": "CONSTRAINT_ALL" + }, + "resource": { + "type": "TYPE_SYSTEM" + } + }, + { + "id": "fb60b004-c1fa-4f09-bf87-55ce7d46ac61", + "name": "Drives.DeleteProject", + "displayName": "Delete AllSpaces", + "description": "This permission allows deleting all spaces.", + "permissionValue": { + "operation": "OPERATION_DELETE", + "constraint": "CONSTRAINT_ALL" + }, + "resource": { + "type": "TYPE_SYSTEM" + } + }, + { + "id": "e9a697c5-c67b-40fc-982b-bcf628e9916d", + "name": "ReadOnlyPublicLinkPassword.Delete", + "displayName": "Delete Read-Only Public link password", + "description": "This permission permits to opt out of a public link password enforcement.", + "permissionValue": { + "operation": "OPERATION_WRITE", + "constraint": "CONSTRAINT_ALL" + }, + "resource": { + "type": "TYPE_SHARE" + } + }, + { + "id": "ad5bb5e5-dc13-4cd3-9304-09a424564ea8", + "name": "EmailNotifications.ReadWriteDisabled", + "displayName": "Disable Email Notifications", + "permissionValue": { + "operation": "OPERATION_READWRITE", + "constraint": "CONSTRAINT_OWN" + }, + "resource": { + "type": "TYPE_SETTING", + "id": "33ffb5d6-cd07-4dc0-afb0-84f7559ae438" + } + }, + { + "id": "522adfbe-5908-45b4-b135-41979de73245", + "name": "Groups.ReadWrite", + "displayName": "Group Management", + "description": "This permission gives full access to everything that is related to group management.", + "permissionValue": { + "operation": "OPERATION_READWRITE", + "constraint": "CONSTRAINT_ALL" + }, + "resource": { + "type": "TYPE_GROUP", + "id": "all" + } + }, + { + "id": "7d81f103-0488-4853-bce5-98dcce36d649", + "name": "Language.ReadWrite", + "displayName": "Permission to read and set the language", + "permissionValue": { + "operation": "OPERATION_READWRITE", + "constraint": "CONSTRAINT_ALL" + }, + "resource": { + "type": "TYPE_SETTING", + "id": "aa8cfbe5-95d4-4f7e-a032-c3c01f5f062f" + } + }, + { + "id": "4ebaa725-bfaa-43c5-9817-78bc9994bde4", + "name": "Favorites.List", + "displayName": "List Favorites", + "description": "This permission allows listing favorites.", + "permissionValue": { + "operation": "OPERATION_READ", + "constraint": "CONSTRAINT_OWN" + }, + "resource": { + "type": "TYPE_SYSTEM" + } + }, + { + "id": "016f6ddd-9501-4a0a-8ebe-64a20ee8ec82", + "name": "Drives.List", + "displayName": "List All Spaces", + "description": "This permission allows listing all spaces.", + "permissionValue": { + "operation": "OPERATION_READ", + "constraint": "CONSTRAINT_ALL" + }, + "resource": { + "type": "TYPE_SYSTEM" + } + }, + { + "id": "b44b4054-31a2-42b8-bb71-968b15cfbd4f", + "name": "Drives.ReadWrite", + "displayName": "Manage space properties", + "description": "This permission allows managing space properties such as name and description.", + "permissionValue": { + "operation": "OPERATION_READWRITE", + "constraint": "CONSTRAINT_ALL" + }, + "resource": { + "type": "TYPE_SYSTEM" + } + }, + { + "id": "a53e601e-571f-4f86-8fec-d4576ef49c62", + "name": "Roles.ReadWrite", + "displayName": "Role Management", + "description": "This permission gives full access to everything that is related to role management.", + "permissionValue": { + "operation": "OPERATION_READWRITE", + "constraint": "CONSTRAINT_ALL" + }, + "resource": { + "type": "TYPE_USER", + "id": "all" + } + }, + { + "id": "4e6f9709-f9e7-44f1-95d4-b762d27b7896", + "name": "Drives.ReadWritePersonalQuota", + "displayName": "Set Personal Space Quota", + "description": "This permission allows managing personal space quotas.", + "permissionValue": { + "operation": "OPERATION_READWRITE", + "constraint": "CONSTRAINT_ALL" + }, + "resource": { + "type": "TYPE_SYSTEM" + } + }, + { + "id": "977f0ae6-0da2-4856-93f3-22e0a8482489", + "name": "Drives.ReadWriteProjectQuota", + "displayName": "Set Project Space Quota", + "description": "This permission allows managing project space quotas.", + "permissionValue": { + "operation": "OPERATION_READWRITE", + "constraint": "CONSTRAINT_ALL" + }, + "resource": { + "type": "TYPE_SYSTEM" + } + }, + { + "id": "3d58f441-4a05-42f8-9411-ef5874528ae1", + "name": "Settings.ReadWrite", + "displayName": "Settings Management", + "description": "This permission gives full access to everything that is related to settings management.", + "permissionValue": { + "operation": "OPERATION_READWRITE", + "constraint": "CONSTRAINT_ALL" + }, + "resource": { + "type": "TYPE_USER", + "id": "all" + } + }, + { + "id": "cf3faa8c-50d9-4f84-9650-ff9faf21aa9d", + "name": "Drives.ReadWriteEnabled", + "displayName": "Space ability", + "description": "This permission allows enabling and disabling spaces.", + "permissionValue": { + "operation": "OPERATION_READWRITE", + "constraint": "CONSTRAINT_ALL" + }, + "resource": { + "type": "TYPE_SYSTEM" + } + }, + { + "id": "a54778fd-1c45-47f0-892d-655caf5236f2", + "name": "Favorites.Write", + "displayName": "Write Favorites", + "description": "This permission allows marking files as favorites.", + "permissionValue": { + "operation": "OPERATION_WRITE", + "constraint": "CONSTRAINT_OWN" + }, + "resource": { + "type": "TYPE_FILE" + } + } + ], + "resource": { + "type": "TYPE_SYSTEM" + } + } +] +```