Who can do what with a file or a label: the one place edms answers it, for its routes and for its listings.
class MMO\edms\helpers\Access
Espace de noms
MMO\edms\helpers
Voir
SHARE (put it in labels), and on a label CREATE (put files in it, make labels under it). A scope without an action is every action.
The rights are mmo.oauth scopes, held by the client (or its roles), keyed by id so a rename changes nothing:
- `edms.files.{id}-{ctime}` a file ([`File::scopeID`](https://mmoframework.fr/documentation/mmo.edms/php/entities/File.md#file-scopeid): its creation time too, as a repository can give the id of a
file deleted to a new one), `edms.labels.{id}` a label and every label under it, `edms.files`/`edms.labels` all
of them, `edms` everything;
- an action narrows it: `edms.labels.12#show`. The actions are [`SHOW`](https://mmoframework.fr/documentation/mmo.edms/php/helpers/Access.md#access-show), [`EDIT`](https://mmoframework.fr/documentation/mmo.edms/php/helpers/Access.md#access-edit), [`DELETE`](https://mmoframework.fr/documentation/mmo.edms/php/helpers/Access.md#access-delete), on a file
A client can do anything with the files it owns and the labels of its own space ([`Label::$owner`](https://mmoframework.fr/documentation/mmo.edms/php/entities/Label.md#label-owner)). With
another's file, the most precise scope set decides, that is, in order:
1. the file's own (`edms.files.{id}-{ctime}`): it can refuse what a label gives;
2. its labels': any label granting the action is enough -- a label, or the closest of its parents holding a
scope. A folder shared is every file in it. A label refusing it, and none granting it, refuses it. The owner
of a label sees the files put in it, and nothing more;
3. the global ones: `edms.files` for any file, `edms.labels` for any file carrying a label;
4. none of them set ([`decideFile`](https://mmoframework.fr/documentation/mmo.edms/php/helpers/Access.md#access-decidefile), [`decideLabel`](https://mmoframework.fr/documentation/mmo.edms/php/helpers/Access.md#access-decidelabel) answer null): the record the file is attached to, when the
application answers for it ([`FileManager::can`](https://mmoframework.fr/documentation/mmo.edms/php/FileManager.md#filemanager-can): on a record, a global tag is one of its rubrics).
Putting a file in labels is sharing it: the owner does, or a client granted [`SHARE`](https://mmoframework.fr/documentation/mmo.edms/php/helpers/Access.md#access-share) on it ([`canShare`](https://mmoframework.fr/documentation/mmo.edms/php/helpers/Access.md#access-canshare)) --
never one who can only edit it, who would give it to the labels of its own space.
$user->allow($label->scopeID('show')); // $user sees every file carrying $label, or one of its children
$access->can($user, Access::SHOW, $file); // true
What the rights say of $action on $file for $client (can), with null when no right says anything: an application can then decide by something else (FileManager::can, the record …
A filter of the files $client can see, for a query to paginate itself: it can hold some $client cannot (a file refusing it, while one of its labels grants it) -- can decides for each.
true if $client can put $file in labels: its owner, or a client granted it (edms.files.{id}-{ctime}#share, edms.files#share...) -- a label's scope never gives it
What the rights say of $action on $file for $client (can), with null when no right says anything: an application can then decide by something else (FileManager::can, the record a file is attached to)
function decideFile(
?MMO\oauth\interfaces\iClient $client,
string $action,
MMO\edms\entities\File $file
): ?bool
A filter of the files $client can see, for a query to paginate itself: it can hold some $client cannot (a file refusing it, while one of its labels grants it) -- can decides for each.