diff --git a/source/includes/available-permissions-path-scope.rst b/source/includes/available-permissions-path-scope.rst index ee45307bc..98ce53c13 100644 --- a/source/includes/available-permissions-path-scope.rst +++ b/source/includes/available-permissions-path-scope.rst @@ -6,38 +6,59 @@ The path level permissions are defined in the file ``permission-mappings-config. * - Permission - Description + * - resolve_conflict - User is permitted to resolve a conflict for a file by accepting ours or theirs |br| Required for using the :ref:`Git project tool ` to resolve a conflict for a file in the UI via the API :base_url:`Resolve conflict <_static/api/studio.html#tag/repository/operation/resolveConflict>` + * - site_diff_conflicted_file - User is permitted to get the difference between ``ours`` and ``theirs`` for a conflicted file for a project |br| Required for using the :ref:`Git project tool ` to get the difference between ``ours`` and ``theirs`` for a conflicted file in the UI or via the API :base_url:`Diff conflicted file <_static/api/studio.html#tag/repository/operation/diffConflictedFile>` - * - publish - - User is permitted to approve submitted content for publishing or publish content from the :ref:`UI ` - or via the API :base_url:`Publish items <_static/api/studio.html#tag/publishing/operation/publishItems>` + + * - publish_approve + - User is permitted to approve submitted content for publishing from the :ref:`UI ` or via + the API :base_url:`Approve request publish submission <_static/api/studio.html#tag/workflow/operation/workflowApprove>` |br| + May also be required when using the API that :base_url:`Publishes the given content to the target (staging or live) <_static/api/studio.html#tag/publishing/operation/publish>`. + + * - publish_request + - User is permitted to publish content to the target (staging or live) from the :ref:`UI ` or via + the API that :base_url:`Publishes the given content to the target (staging or live) <_static/api/studio.html#tag/publishing/operation/publish>` |br| + Also required by the API :base_url:`Get available publishing targets for site <_static/api/studio.html#tag/publishing/operation/getAvailablePublishingTargets>` + Users need both `publish_approve` and `publish_request` to be able to publish immediately without approval. + + * - publish_reject + - User is permitted to reject a publish package waiting for approval from the :ref:`UI ` or via + the API :base_url:`Reject request publish submission <_static/api/studio.html#tag/workflow/operation/workflowReject>` + * - content_copy - User is permitted to copy content from the UI :ref:`Sidebar ` or the :ref:`Toolbar ` options |br| Note that this permission enables the ``copy`` action in the UI but it does not enable the user to paste the items. Paste requires ``content_write`` permission + * - content_create - User is permitted to create new content from the UI :ref:`Sidebar ` or the :ref:`Toolbar ` options |br| Note that this permission enables the action in the UI but it does not enable the user to create the content. Actual content creation requires ``content_write`` permission + * - content_delete - User is permitted to delete content from the UI :ref:`Sidebar ` or the :ref:`Toolbar ` options or via the API :base_url:`Delete content <_static/api/studio.html#tag/content/operation/getDeletePackage>` + * - content_read - User is permitted to read content from the UI or use various APIs e.g. getting the history for a content item via the API :base_url:`Get item history <_static/api/studio.html#tag/content/operation/getItemHistory>`, getting the preview image of a given content type via the API :base_url:`Get content type preview image <_static/api/studio.html#tag/content/operation/getContentTypePreviewImage>`, etc. + * - content_write - User is permitted to edit content in the UI or use various APIs e.g. renaming content via the API :base_url:`Rename content <_static/api/studio.html#tag/content/operation/contentRename>`, etc. + * - folder_create - User is permitted to create new folder + * - item_unlock - User is permitted to unlock items |br| Required when using the API to :base_url:`unlock item by path <_static/api/studio.html#tag/content/operation/itemUnlockByPath>` diff --git a/source/includes/available-permissions-project-scope.rst b/source/includes/available-permissions-project-scope.rst index 3cb3ff6ae..9bea65a1d 100644 --- a/source/includes/available-permissions-project-scope.rst +++ b/source/includes/available-permissions-project-scope.rst @@ -6,74 +6,100 @@ The project level permissions are defined in the file ``permission-mappings-conf * - Permission - Description + * - add_remote - User is permitted to add a remote repository to the project. |br| Required for using the :ref:`Git project tool ` to add a repository in a project using the ``New Remote`` button which uses the :base_url:`Add remote repository <_static/api/studio.html#tag/repository/operation/addRemoteRepository>` API. + * - cancel_failed_pull - User is permitted to cancel a failed pull from a repository. |br| Required for using the :ref:`Git project tool ` to cancel a failed pull in the UI via the API :base_url:`Cancel failed pull <_static/api/studio.html#tag/repository/operation/cancelFailedPull>` + * - commit_resolution - User is permitted to commit resolution |br| Required for using the :ref:`Git project tool ` to commit resolution in the UI via the API :base_url:`Commit resolution <_static/api/studio.html#tag/repository/operation/commitResolution>` + * - list_remotes - User is permitted to list remote repositories for a project |br| Required for using the :ref:`Git project tool ` to list remote repositories for a project in the UI via the API :base_url:`List remote repositories <_static/api/studio.html#tag/repository/operation/listRemoteRepositories>` + * - pull_from_remote - User is permitted to pull content from remote repository to project content repository |br| Required for using the :ref:`Git project tool ` to pull content from remote repository in the UI via the API :base_url:`Pull from remote repository <_static/api/studio.html#tag/repository/operation/pullFromRemoteRepository>` + * - push_to_remote - User is permitted to push content to remote repository from project content repository |br| Required for using the :ref:`Git project tool ` to push content to remote repository in the UI via the API :base_url:`Push to remote repository <_static/api/studio.html#tag/repository/operation/pushToRemoteRepository>` + * - remove_remote - User is permitted to remove remote repository from project content repository |br| Required for using the :ref:`Git project tool ` to remove remote repository from project in the UI via the API :base_url:`Remove remote repository <_static/api/studio.html#tag/repository/operation/removeRemoteRepository>` + * - repair_repository - User is permitted to repair the repository - * - cancel_publish + + * - publish_cancel - User is permitted to cancel a publish request from the :ref:`UI ` - or via the API :base_url:`Cancel publishing packages <_static/api/studio.html#tag/publishing/operation/cancelPublishingPackages>` - * - get_publishing_queue + or via the API :base_url:`Cancel publish packages <_static/api/studio.html#tag/workflow/operation/cancelPublishPackages>` + + * - publish_get_queue - User is permitted to get the list of packages in the publishing queue from the :ref:`UI ` - or via the API :base_url:`Publishing packages <_static/api/studio.html#tag/publishing/operation/PublishingPackages>` |br| - Also required by the API :base_url:`Get package details <_static/api/studio.html#tag/publishing/operation/getPublishingPackageDetails>` + or via the API :base_url:`Get publish packages <_static/api/studio.html#tag/publishing/operation/GetPublishPackages>` |br| + Also required by the following APIs: + + - :base_url:`Get package details <_static/api/studio.html#tag/publishing/operation/getPublishPackage>` + - :base_url:`Get publish package items <_static/api/studio.html#tag/publishing/operation/getPublishPackageItems>` + - :base_url:`Get workflow affected packages <_static/api/studio.html#tag/workflow/operation/getWorkflowAffectedPackages>` + * - publish_status - User is permitted to get the publishing status from the :ref:`UI ` or via the API :base_url:`Get publishing status <_static/api/studio.html#tag/publishing/operation/getPublishingStatus>` + * - publish_by_commits - User is permitted to publish commits from sandbox repository by commit id from the :ref:`UI ` or via the API :base_url:`Publish commits <_static/api/studio.html#tag/publishing/operation/publishCommits>` + * - start_stop_publisher - User is permitted to start/stop the publisher from the :ref:`UI ` + * - view_logs - User is permitted to view logs from the :ref:`project tools UI ` or :ref:`Main Menu UI ` depending on where the permission is configured (project or global/system) + * - audit_log - User is permitted to access the audit logs in the UI from the :ref:`main menu ` or the :ref:`project tools ` via the API :base_url:`Get audit log <_static/api/studio.html#tag/audit/operation/getAuditLog>` + * - content_search - User is permitted to search for content from the UI + * - s3_read - User is permitted to get a list of items from an S3 bucket defined in the :ref:`AWS S3 profile ` configured.|br| This is required when using the API to :base_url:`Get a list of items from an S3 bucket <_static/api/studio.html#tag/aws/operation/listItems>` + * - s3_write - User is permitted to upload a file to an S3 bucket defined in the :ref:`AWS S3 profile ` configured.|br| This is required when using the API to :base_url:`Upload a file to an S3 bucket <_static/api/studio.html#tag/aws/operation/uploadItems>`, etc. + * - webdav_read - User is permitted to get a list of items from a WebDAV server configured in the :ref:`WebDAV profiles ` configuration file. |br| This is required when using the API to :base_url:`Get a list of items from a WebDAV server <_static/api/studio.html#tag/webdav/operation/listItemsWebdav>` + * - webdav_write - User is permitted to upload a file to a WebDAV server configured in the :ref:`WebDAV profiles ` configuration file. |br| This is required when using the API to :base_url:`Upload a file to a WebDAV server <_static/api/studio.html#tag/webdav/operation/uploadItemsWebdav>` + * - encryption_tool - User is permitted to access the :ref:`encryption tool ` |br| Required when using the API to :base_url:`Encrypt a text value <_static/api/studio.html#tag/security/operation/encrypt>` + * - get_children - User is permitted to call getChildren* APIs for browsing project content |br| Required when using the following APIs: @@ -81,32 +107,39 @@ The project level permissions are defined in the file ``permission-mappings-conf - :base_url:`Get list of children for given item paths <_static/api/studio.html#tag/content/operation/getChildrenByPaths>` - :base_url:`Get item details for given an item path <_static/api/studio.html#tag/content/operation/getDetailedItemByPath>` - :base_url:`Get list of items for given item paths <_static/api/studio.html#tag/content/operation/getSandboxItemsByPath>` + * - install_plugins - User is permitted to :ref:`install plugins ` |br| Required when using the following APIs: - :base_url:`Install plugin <_static/api/studio.html#tag/marketplace/operation/installPlugin>` - :base_url:`Copy local plugin <_static/api/studio.html#tag/marketplace/operation/copyPlugin>` + * - list_plugins - User is permitted to list installed plugins |br| Required when using the API to :base_url:`get the list of marketplace plugins installed in the given site <_static/api/studio.html#tag/marketplace/operation/getInstalledPlugins>` + * - remove_plugins - User is permitted to :ref:`remove installed plugins ` |br| Required when using the following APIs: - :base_url:`Remove plugin <_static/api/studio.html#tag/marketplace/operation/removePlugin>` - :base_url:`Plugin usage <_static/api/studio.html#tag/marketplace/operation/pluginUsage>` + * - set_item_states - User is permitted to set item states |br| Required when using the following APIs: - :base_url:`Set item states <_static/api/studio.html#tag/workflow/operation/setItemStates>` - :base_url:`Update item states <_static/api/studio.html#tag/workflow/operation/updateItemStates>` + * - site_status - User is permitted to :ref:`get status of repository for a project ` |br| Required when using the API :base_url:`Repository status <_static/api/studio.html#tag/repository/operation/repositoryStatus>` + * - unlock_repository - User is permitted to unlock the repository + * - read_configuration - User is permitted to read configuration content for project |br| Required when using the following APIs: @@ -114,6 +147,7 @@ The project level permissions are defined in the file ``permission-mappings-conf - :base_url:`Get all model definitions for site <_static/api/studio.html#tag/model/operation/getAllModelDefinitions>` - :base_url:`Get configuration content for site and configuration location <_static/api/studio.html#tag/configuration/operation/getConfiguration>` - :base_url:`Get configuration history for site and configuration location <_static/api/studio.html#tag/configuration/operation/getConfigurationHistory>` + * - write_configuration - User is permitted to write configuration content for project |br| Required when using the following APIs: diff --git a/source/includes/available-permissions-system-scope.rst b/source/includes/available-permissions-system-scope.rst index 7cb9743bd..2d56eb93d 100644 --- a/source/includes/available-permissions-system-scope.rst +++ b/source/includes/available-permissions-system-scope.rst @@ -6,34 +6,44 @@ The system level (global) permissions are defined in the file ``global-permissio * - Permission - Description + * - configure_log_levels - User is permitted to configure log levels from the :ref:`UI ` or via the API :base_url:`Loggers update level <_static/api/studio.html#tag/loggers/operation/loggersUpdateLevel>` + * - view_logs - User is permitted to view logs from the :ref:`project tools UI ` or :ref:`Main Menu UI ` depending on where the permission is configured (project or global/system) + * - view_log_levels - User is permitted to view log levels from the :ref:`Main Menu UI ` - or via the API :base_url:`Loggers get all <_static/api/studio.html#tag/loggers/operation/loggersGetAll>` + or via the API :base_url:`Get all loggers and their configured priority levels <_static/api/studio.html#tag/loggers/operation/loggersGetAll>` + * - audit_log - User is permitted to access the audit logs in the UI from the :ref:`main menu ` or the :ref:`project tools ` via the API :base_url:`Get audit log <_static/api/studio.html#tag/audit/operation/getAuditLog>` + * - duplicate_site - User is permitted to :ref:`duplicate a project ` + * - create_site - User is permitted to :ref:`create projects ` + * - delete_site - User is permitted to delete projects |br| This is required when using the API to :base_url:`Delete a project <_static/api/studio.html#tag/sites/operation/deleteSite>` + * - edit_site - User is permitted to edit sites |br| Required when using the following APIs: - :base_url:`Update the name and description for a given site <_static/api/studio.html#tag/sites/operation/updateSite>` - :base_url:`Unlock a site locked with state LOCKED <_static/api/studio.html#tag/sites/operation/unlockSite>` + * - create_groups - User is permitted to :ref:`create new groups ` |br| Required when using the API to :base_url:`Create group <_static/api/studio.html#tag/groups/operation/createGroup>` + * - read_groups - User is permitted to read groups |br| Used for :ref:`administering groups ` @@ -42,6 +52,7 @@ The system level (global) permissions are defined in the file ``global-permissio - :base_url:`Get all groups <_static/api/studio.html#tag/groups/operation/getGroups>` - :base_url:`Get group by ID <_static/api/studio.html#tag/groups/operation/getGroup>` - :base_url:`Get all the members of the specified group <_static/api/studio.html#tag/groups/operation/getGroupMembers>` + * - update_groups - User is permitted to update groups |br| Used for :ref:`administering groups ` @@ -49,30 +60,58 @@ The system level (global) permissions are defined in the file ``global-permissio - :base_url:`Update group <_static/api/studio.html#tag/groups/operation/updateGroups>` - :base_url:`Add member(s) to the specified group <_static/api/studio.html#tag/groups/operation/addGroupMembers>` + * - delete_groups - User is permitted to :ref:`delete groups ` |br| Required when using the following APIs: - :base_url:`Delete group <_static/api/studio.html#tag/groups/operation/deleteGroup>` - :base_url:`Remove member(s) from the specified group <_static/api/studio.html#tag/groups/operation/removeGroupMembers>` + * - create_users - User is permitted to :ref:`create new users ` |br| Required when using the API to :base_url:`Create user <_static/api/studio.html#tag/users/operation/createUser>` + + * - read_users + - User is permitted to read users. Used in the :ref:`Users Management Console ` |br| + Required when using the following APIs: + + - :base_url:`Get users <_static/api/studio.html#tag/users/operation/getUsers>` + - :base_url:`Get user <_static/api/studio.html#tag/users/operation/getUser>` + - :base_url:`Get user sites <_static/api/studio.html#tag/users/operation/getUserSites>` + - :base_url:`Get user site roles <_static/api/studio.html#tag/users/operation/getUserSiteRoles>` + + * - update_users + - User is permitted to update users. Used in the :ref:`Users Management Console ` |br| + Required when using the following APIs: + + - :base_url:`Update user <_static/api/studio.html#tag/users/operation/updateUser>` + - :base_url:`Enable user <_static/api/studio.html#tag/users/operation/enableUser>` + - :base_url:`Disable user <_static/api/studio.html#tag/users/operation/disableUser>` + - :base_url:`Reset user password <_static/api/studio.html#tag/users/operation/resetUserPassword>` + * - delete_users - User is permitted to :ref:`delete users ` |br| Required when using the API to :base_url:`Create user <_static/api/studio.html#tag/users/operation/deleteUser>` + * - encryption_tool - User is permitted to access the :ref:`encryption tool ` |br| Required when using the API to :base_url:`Encrypt a text value <_static/api/studio.html#tag/security/operation/encrypt>` + * - install_plugins - User is permitted to :ref:`install plugins ` |br| Required when using the following APIs: - :base_url:`Install plugin <_static/api/studio.html#tag/marketplace/operation/installPlugin>` - :base_url:`Copy local plugin <_static/api/studio.html#tag/marketplace/operation/copyPlugin>` + * - list_plugins - User is permitted to list installed plugins |br| Required when using the API to :base_url:`get the list of marketplace plugins installed in the given site <_static/api/studio.html#tag/marketplace/operation/getInstalledPlugins>` + + * - search_plugins + - User is permitted to :ref:`search for plugins ` + * - manage_access_token - User is permitted to :ref:`manage the access tokens ` |br| Required when using the following APIs: @@ -81,32 +120,17 @@ The system level (global) permissions are defined in the file ``global-permissio - :base_url:`Create access token <_static/api/studio.html#tag/security/operation/createAccessToken>` - :base_url:`Update access token <_static/api/studio.html#tag/security/operation/updateAccessToken>` - :base_url:`Delete access token <_static/api/studio.html#tag/security/operation/deleteAccessToken>` - * - read_users - - User is permitted to read users. Used in the :ref:`Users Management Console ` |br| - Required when using the following APIs: - - :base_url:`Get users <_static/api/studio.html#tag/users/operation/getUsers>` - - :base_url:`Get user <_static/api/studio.html#tag/users/operation/getUser>` - - :base_url:`Get user sites <_static/api/studio.html#tag/users/operation/getUserSites>` - - :base_url:`Get user site roles <_static/api/studio.html#tag/users/operation/getUserSiteRoles>` - * - update_users - - User is permitted to update users. Used in the :ref:`Users Management Console ` |br| - Required when using the following APIs: - - - :base_url:`Update user <_static/api/studio.html#tag/users/operation/updateUser>` - - :base_url:`Enable user <_static/api/studio.html#tag/users/operation/enableUser>` - - :base_url:`Disable user <_static/api/studio.html#tag/users/operation/disableUser>` - - :base_url:`Reset user password <_static/api/studio.html#tag/users/operation/resetUserPassword>` - * - search_plugins - - User is permitted to :ref:`search for plugins ` * - read_cluster |enterpriseOnly| - User is allowed to list the cluster members and the cluster mode (PRIMARY vs REPLICA) |br| Required when using the following APIs: - :base_url:`Get the local Studio instance cluster mode <_static/api/studio.html#tag/cluster/operation/getClusterMode>` - :base_url:`Get all the members of the cluster <_static/api/studio.html#tag/cluster/operation/getClusterMembers>` + * - write_global_configuration - User is permitted to write global configuration content for Studio + * - system_properties_manage - User is allowed to update, write or delete system properties. |br| Required when using the following APIs: