QVCS-Enterprise QVCS-Enterprise

Roles, Privileges, and Actions

QVCS-Enterprise provides a role/privilege/action approach to authorization. Each user is assigned one or more roles for a project. When a user tries to perform an action, the server checks to see if any of the roles assigned to the user has the privilege to perform the requested action. If any of the user's assigned roles have the privilege to perform the requested action, action will be allowed; if none of the user's roles have the required privilege, the action will be denied.

For example, in order to checkin any changes for a given project, a user must have the "Check in" privilege. The pre-defined WRITER and DEVELOPER roles have this privilege enabled. As a consequence, if a user is assigned the WRITER and/or DEVELOPER roles, they will be allowed to checkin a file for the given project.

In order to even view a project, a user must have a "Get file" privilege. The pre-defined READER and DEVELOPER roles have this privilege enabled.

The ADMIN user, using the ADMIN tool, can define new roles to create a customized set of privileges for the given role. For example, it might make sense to create a TESTER role that included only those specific privileges needed for a TESTER to perform their job.

Role assignments are always at the project level. This means that a user may have different roles for different projects.

This table lists all the actions that can be requested, and identifies which built-in roles include that privilege.

Action/Privilege:Pre-defined role(s) that include this privilege
(Admin tool): Add user rolePROJECT_ADMIN
(Admin tool): Remove user rolePROJECT_ADMIN
(Admin tool): Assign user rolesPROJECT_ADMIN
(Admin tool): List project usersPROJECT_ADMIN
(Admin tool): List user rolesPROJECT_ADMIN
(Admin tool): Maintain projectPROJECT_ADMIN
Add directoryPROJECT_ADMIN
Delete directoryPROJECT_ADMIN
Maintain viewPROJECT_ADMIN
Show cemeteryCEMETERY_ADMIN
Break lockPROJECT_ADMIN
Get fileREADER, DEVELOPER
Get directoryREADER, DEVELOPER
Check outWRITER, DEVELOPER
Check inWRITER, DEVELOPER
LockWRITER, DEVELOPER
UnlockWRITER, DEVELOPER
LabelWRITER, DEVELOPER
Label directoryWRITER, DEVELOPER
Label at checkinWRITER, DEVELOPER
Remove labelWRITER, DEVELOPER
Remove label from directoryWRITER, DEVELOPER
Rename fileWRITER, DEVELOPER
Move fileWRITER, DEVELOPER
Delete fileWRITER, DEVELOPER
Set file attributesWRITER, DEVELOPER
Set comment prefixWRITER, DEVELOPER
Set file descriptionWRITER, DEVELOPER
Set revision descriptionWRITER, DEVELOPER
Create archiveWRITER, DEVELOPER

In addition to the actions listed above, there are several actions that can only be performed by the ADMIN user using the admin tool. These actions are:

Action:Purpose:
Add user to serverDefines a user so they can login to the server.
Remove user from serverRemoves an existing user so they cannot login to the server.
Maintain role privilegesAllows the ADMIN user to define and modify roles and their associated privileges.
Create ProjectCreate a new project.
Delete ProjectDelete an existing project.
Shutdown ServerRequest the server to shutdown.

The ADMIN role is built-in, and its privileges cannot be altered. The other built-in roles' privileges may be altered by the ADMIN user.