cs-c | cs-as | m-c | m-as | green = works as expected and agreed upon | red = does NOT work as expected and agreed upon | yellow = unsure | |||||
Consensus vs. Needs Confirmaton | Behavior | Access Role |
| Expected to work based on description for Collections | Works now for Admin Sets | Expected to work based on description for Admin Sets | Comments | ||||
---|---|---|---|---|---|---|---|---|---|---|---|
Impacting collections/adminsets | |||||||||||
√ | edit_access in solr_doc to collection/adminset | manager | YES | manager can modify collection metadata | YES | manager can edit the set metadata, participants, and release and visibility settings | |||||
√ | depositor | NO | NO | ||||||||
√ | viewer | NO | NO | ||||||||
√ | read_access in solr doc to collection/adminset | manager | NO | NO | |||||||
√ | Should depositors have read access? I propose an additional setting for sharing that allows this to be ON/OFF for a collection type. | depositor | NO | depositor can view the collection | NO | In general...
| |||||
√ | I propose that Viewer of admin sets SHOULD have read access. | viewer | YES | viewer can view the collection even if the visibility permissions of the collection otherwise would not permit them to view it. | NO | Rationale... A user who is granted special access to a collection/admin set have a higher need to be able to see the collection/admin set's metadata and list of works. | |||||
√ | access to collection/adminset index | manager | YES | YES | |||||||
√ | If granted read access, depositors will see admin sets in Managed Collections. | depositor | YES | depositor can view the collection | NO | Depositors do NOT see admin sets in Managed Collections. NOTE: Managed Collections does not yet exist at master. | |||||
√ | If granted read access, viewers will see admin sets in Managed Collections. | viewer | YES | viewer can view the collection even if the visibility permissions of the collection otherwise would not permit them to view it. | NO | Viewers do NOT see admin sets in Managed Collections. NOTE: Managed Collections does not yet exist at master. | |||||
create collection/adminset | any user | SORT OF | ADMINs only | For collections, who can create collections of a particular type is limited to collection type managers and creators. The admin set collection type also controls who can create admin sets, but the collection type for admin sets is hard coded to only allow admins to do this. | |||||||
√ | delete collection/adminset | manager | YES | manager delete the collection | YES | ||||||
√ | depositor | NO | NO | Can't see admin sets. Need to re-test after granting read access. | |||||||
√ | viewer | NO | NO | Can't see admin sets. Need to re-test after granting read access. | |||||||
√ | access to collection/adminset show page | manager | YES | YES | via :edit access to the collection | ||||||
√ | Determined by having read access to the collection/adminset. | depositor | NO | depositor can view the collection | NO | PROPOSED change to YES-- via :read access to the collection & admin set | |||||
√ | Determined by having read access to the collection/adminset. | viewer | YES | NO | PROPOSED change to YES for admin sets -- via :read access to the admin set | ||||||
√ | access to collection/adminset edit page | manager | YES | manager can modify collection metadata | YES | manager can edit the set metadata, participants, and release and visibility settings | |||||
√ | depositor | NO | NO | ||||||||
√ | viewer | NO | NO | ||||||||
add works to collection/adminset | manager | YES | manager can add to and remove works from the collection | YES | |||||||
Granting read access will allow depositor to add works from admin show page. | depositor | YES | depositor can add works to to the collection | YES | depositor can add new works to this administrative set | Currently, without read access to collection, a depositor can only add works to a collection via Work → Relationship Tab OR via bulk add to collection on Dashboard → Works index page. PROPOSED change to grant depositor read access will allow depositors to add works from the collection admin show page. | |||||
viewer | NO | NO | |||||||||
remove works from collection/adminset | manager | YES, IF | manager can add to and remove works from the collection | NO | YES IF requires_membership? false NO IF requires_membership? trueNOTE: Admin sets has requires_membership == true | ||||||
depositor | ? | ? | |||||||||
viewer | NO | NO | |||||||||
move works between collection/adminset | manager | YES | manager can add to and remove works from the collection | YES | YES when moving between collections of the same type YES when moving between different collection types IF requires_membership? false Minimally, manager has to be a manager/depositor to both collections NOTE: Move is currently only allowed from edit work Relationships tab, by selecting different collections/admin set. | ||||||
depositor | NO | NO | Requires edit access to the work. | ||||||||
viewer | NO | NO | |||||||||
Consensus vs. Needs Confirmaton | Behavior | Access Role |
| Expected to work based on description for Collections | Works now for Admin Sets | Expected to work based on description for Admin Sets | Comments | ||||
Impacting works | |||||||||||
edit_access in solr_doc to new works | manager | YES | manager can edit work metadata | YES | manager can edit work metadata | Applied at create time when a work is created in just one collection. Admin set participants are applied every time a work is created. Collection and admin set permissions are additive. | |||||
depositor | NO | NO | |||||||||
viewer | NO | NO | |||||||||
read_access in solr doc to collection/adminset | manager | NO | NO | ||||||||
depositor | NO | depositor can view the collection | NO | ||||||||
viewer | YES | viewer can view it even if the visibility permissions of the collection otherwise would not permit them to view it | YES | viewer can view works in the set regardless of the visibility settings applied to the work | Applied at create time when a work is created in just one collection. Admin set participants are applied every time a work is created. Collection and admin set permissions are additive. | ||||||
All other access to works is based on the edit and read access grants and is controlled by the standard abilities process. |
For Admin Sets:
permission_ template_ access | admin set solr doc | ability: can? create_in_adminset | can access through UI via Dashboard → Administrative Sets | work solr doc | comments |
---|---|---|---|---|---|
Definition on participants tab: Managers of this administrative set can
NOTE: Manager is granted access to works and their files only FOR WORKS CREATED AFTER USER BECAME MANAGER Additional things a manager can do not specifically mentioned in the definition
| Any differences from Collections? (checked if same)
| ||||
:manage | edit_access | true | YES | edit_access | Admin user creating the admin set is not given edit_access as a user until a manager is added. This does not have much of an impact as the user is part of the admin group and gets access through that group. |
Depositors of this administrative set can
| |||||
:deposit | N/A | true | NO | Access to works are granted only for works the user creates. | |
Viewers of this administrative set can
Additional functionality expected not directly mentioned in the definition
| |||||
:view | N/A | false | NO | read_access | The user is NOT given read access to the admin set and therefore cannot view the admin set through the UI. |
For Collections:
permission_ template_ access | definition in UI | collection solr doc | ability: can? create_in_collection | work solr doc | comments |
---|---|---|---|---|---|
Managers of this collection can
| |||||
:manage | edit_access | true | edit_access | admin is always a manager | |
:deposit | Depositors of this collection can
| read_access | true | access to works are granted only for works the user creates | |
:view | Viewers of this collection can
| read_access | false | read_access |
NOTE: There is a difference in definitions and in read_access set on admin_sets and collections for depositors and viewers. I would propose that Admin Sets use the same behavior as collections. This change will results in Depositors and Viewers being able to view the admin show page of the admin set AND see them listed in Managed Collections tab in Dashboard → Collections.
This makes sense for viewers since they must have some special connection with the admin set to be able to see works in it even when they are embargoed or private. This can make sense for depositors when there are multiple admin sets being used for organization.
My concern is for the special case of a site using a default admin set because they have to. Users must be able to deposit in it. In this case, the default admin set is the full set of all works in the repository. It does not make sense for users to view the show page for that admin set or see it in Managed Collections.