Function permissions – system description

Overview

Per-user assignment of function permissions (layer 2), the legacy group matrix, and loading a plan onto a user. The menu item is shown to the super admin only. Table names carry the installation's own prefix in the database.

List and form

• List (permission): one row per user – name, group, status, active and total manual rows, last addition.
• form: user selector (every base user), all user_feature rows of the user (all sources), the loaded plan choice (selection), definitions and their plans.
• featuresearch: finds every active function regardless of classification, at most 12 hits (by route, key, name, module). The right column only shows existing rows.
• functiontree: menu group → list → function tree, only with routes of MENU_GROUPS; the form does not load it.

Saving (saveUserFeatureRows())

1. Per row: access_mode, offer_definition_id, limit (count, amount, metered, unlimited), unit price, included quantity, overage price, discount, currency, date window.
2. Existing row UPDATE (is_override = 1 on change), new row INSERT with source = 'manual'.
3. Every row of the user not in the POST is DELETED, whatever its source.
4. With a truncated POST (rows_count mismatch) nothing is saved (error_truncated).
5. Then syncCoreRouteAccess(), and a read-back check of the rows (warning_not_persisted + log).

deactivateuser: deletes all manual rows of the user(s). togglestate: Dlbtprovision::setEnabled().

Loading a plan (generate, SYSTEM)

planpreview: getPlanPreviewRows() → rows of Dlbtprovision::resolveTemplate(), without writing. generate: materialise(user, def, plan, from, to, admin, 'subscription') in REPLACE mode – every user row not in the plan is deleted (manual and is_override too). Permission: super, or base access (preview) or modify (save) AND canAction(generate).

Legacy group endpoints

permission.matrix (group template matrix; base access or super), permission.permissions (a group's selections; access), permission.groupsave (modify: the group's route permissions, list and access sync, group template rows with source role and date window), permission.install (modify: the module's tables and seed).

Permissions and limitations

• List and form ask for the base route permission (access, modify) or super admin; in the seed list is UNMAPPED, but the controller does not check it.
• The add button asks for canAction(add), but the add key is not in the master, so it is false for non-super users.
• There is no content scope (which user's rights one may edit).