OMERO Permissions

permissions.md

In-use

• rw---- : private group (admin can read)
• rwr--- : collab. read-only
• rwra-- : collab. read-annotate

Currently proposed

• r----- : and
• r-r--- : strictly-read only; NO CHANGES. "Published" Note: we also need group-admin-only write Do we use another flag for that? ra----?
• rwrw-- : collab. read-write (already possible in server) Allows non-group-admins to delete, etc.

Possibly useful

• ------ : Disabled group?
• rar--- : Group can see; data is locked but annotatable
• rara-- : Data is still locked but annotatable by group.

Possibly useful if we allow non-group login

This would make the anonymous ("Public") user unnecessary, so perhaps not worth the effort.

• rarar- : Everyone can see, group can annotate
• rarara : Everyone can see, anyone can annotate
• rwrara : as above, but I can modify my data.
• r-r-r- : ... etc ...
• rar-r-
• rwr-r-
• rwrwra
• rwrwrw
• rwrwrw
• rwrwra
• rwrwr-
• rwrara
• rwrar-

Probably Useless

In general, all broken due to "I have lower permissions then others who I trust less"

• rwrarw
• rwr-rw
• rwr-ra
• rarwrw
• rarwra
• rarwr-
• rararw
• rar-rw
• rar-ra
• r-rwrw
• r-rwra
• r-rwr-
• r-rarw
• r-rara
• r-rar-
• r-r-rw
• r-r-ra
• rwrarw
• rw--rw
• rw--ra
• rarwrw
• rarwra
• rarw--
• rararw
• ra--rw
• ra--ra
• --rwrw
• --rwra
• --rw--
• --rarw
• --rara
• --ra--
• ----rw
• ----ra
• rw--r-
• ra--r-
• r-rw--
• r-ra--
• r---rw
• r---ra
• r---r-
• --rwr-
• --rar-
• --r-rw
• --r-ra
• --r-r-
• --r---
• ----r-

It might be easier to read (though less familiar to Unix heads) to use only a single letter for each of owner, group and world: W=read/write, A=read/annotate, R=read-only, -=nothing. After all, things like "-w-w-w" also make little sense here. If we also assume we want owner >= group >= world, then we have 20 unique combinations:

• WWW
• WWA
• WWR
• WW-
• WAA
• WAR
• WA-
• WRR
• WR-
• W--
• AAA
• AAR
• AA-
• ARR
• AR-
• A--
• RRR
• RR-
• R--
• ---

It's an interesting suggestion for representation, @ctrueden, thanks. Leave it up to others if that makes the discussion easier. The DB and the model objects will only use and except the longer ones, so we'll just need to make sure we don't lose sight of that.