Setup new role

A role is very simply a Group with the sub-type Role.

This allows you to use all of the CGScript functions on groups, imports, export, and the many other system features there are on groups.

Minimum requirements

In order for a role to function, it must defined a minimum of two Role extensions.

• "Added" - is called AFTER a user has been added to the role
• "Removed" - is called AFTER a user has been removed from the role.

Suggested folder structure

The roles does not have a required folder structure beyond defining where the role extensions themselves are located. How the access to the resources that membership of the role itself is not actually part of the role structure, but in order to facilitate an easy way to get an overview of any role, here is a suggestion for how to setup a new product that utilizes roles to ensure the proper access to all resources.

In our example, that we will call RRR, we have the following requirements:

Requirements

• RRR is fundamentally a product that consist of a series of questionnaire A, B and C, a reporting portal for each questionnaire for individuals, and a reporting portal for department leaders again for each qnaire.
• Sales to RRR is through multiple channels
  • The owners, which we shall call SuperAdmins, may sell either to individuals, companies or resellers.
  • Companies may "sell" to their departments.
  • Resellers can sell to other companies.
  • In all cases the seller needs to be able to administrate access to RRR for the buyer, however the seller is NOT allowed to be able to access the data collected in RRR.
  • Companies and individuals may buy access online.
  • The seller may restrict access to a limited set of qnaires.
• Administration of user (HR admins) in a reseller, company or department should be possible without having to pay for the account to do so
• Payment is based on price per user that has access to a questionnaire, so qnaire A may cost 10 and qnaire B may cost 20.

Access

Since RRR ask sensitive information access to each persons answers is restricted:

• A user only has access to view their own data
• A HR admin has to the user, not the collected data of the user

• A department leader only has access the user as the HR admin, but also has access to aggregated data for the departments members.
• Administration of user in a reseller, company or department should be possible without having to pay for the account to do so

TODO access for individual that buys 2 qnaires?