#
# User access permissions
#
# See directions at end of file.
#

group admin	mack bobby apache	### allow for demo

# Base security for all
secure all
deny	all			guest nobody
deny	delete			all
allow	access,insert,update	nobody	### for demo

# System administration
secure admin.cgi
deny  all			all
allow all			admin

# General SQL statement entry on admin.cgi screen
secure SQL
deny  all			all
allow all			admin

# General SQL statement export
secure SQL_EXPORT
deny  all			all
allow all			admin

# System tables -- to be modified by sys admins
secure calendar_reports	inventory_tables
deny  all			all
allow all			admin

# Holidays & Vacations -- entered/changed only by administrator
# Restrict calendar_events rows of holidays and the vacations calendars.
restrict holidays vacations
deny	insert,update,delete	all
allow	all			admin

# Programs
secure /cgi-bin/list/email.cgi
deny all all
allow access			mack bobby apache ### for demo

__END__


There are five keyword commands:

	secure
	restrict
	allow
	deny

	group

They must be the first word on a line to be recognized. The capitalization
of keywords does not matter.

The "secure" keyword begins the list of codes that the following "allow"
and "deny" privileges apply to. All the following words, even on the following
lines, up to either "allow" or "deny" are interpreted as security codes.

The "restrict" keyword is a synonym for "secure". The AcmeBase schema files
use "restrict" codes in addition to "secure" codes, so it is used here too.

Security codes, the codes following the "secure" keyword, can be any of
the following:

	a program file pathname
	a database table name
	a database column name (if there is also an entry for the table name)
	a security code defined in the AcmeBase schema file for a table or column
	a form name
	a form template file name
	one of the following keywords:
		SQL
		SQL_EXPORT
		ALL

Program path names can be either "absolute" or "relative" file names.
Absolute path names begin with / and are relative to the site's root
directory. Relative path names do not begin with / and are relative
to the current working directory, which is usually /cgi-bin/. 
Specify the program file path names like they are specified in the site
configuration file (etc/site.conf) and in the AcmeBase schema files.

The code word "SQL" controls who can enter arbitrary SQL statements in the
administration screen. "SQL_EXPORT" controls who is allowed to export the
SQL results.

The first word after the keyword "allow" or "deny" is the privilege code.
The term "first word" is used loosely as it can contain punctuation such as
commas, but it cannot contain any spaces unless it is enclosed in quotes
(" or ').

There are four keywords used for privileges:

	Access
	Insert
	Update
	Delete

They are all listed together (without spaces) as the first word of the
"allow" or "deny" lines, like: 

	access,insert,update

Another way of specifying a privilege for "allow" or "deny" is to create
a code using the first character of each privilege you want to allow or deny,
like:

	AIUD
	-or-
	aiu

The keyword "ALL" can also be use to refer to all privileges.

The words following the "allow" or "deny" privilege codes are user names or
the keyword "ALL" to symbolize all users.

The user name is the name returned by the Local::Acme::User::user() function,
which is usually their login name. The group names of which the user belongs
to is usually determined by their login settings. They are obtained using the
Local::Acme::User::user_groups() function.

The keyword "group" augments the groups the user belongs too. User groups
are sometimes easier to maintain in this file instead of elsewhere. The
first word after the keyword "group" is the name of the group followed by
a list of user names belonging to the group. The group name can be used in
lieu of user names in "allow" and "deny" privileges.

Everything from the # character to the end of a line is ignored.

The process for determining if the user has the requested privilege for
a security code is:

    Privilege is allowed if user privilege is found in "allow".
    Privilege is denied if user privilege is found in "deny".

    Privilege is allowed if user's group(s) privilege is found in "allow".
    Privilege is denied if user's group(s) privilege is found in "deny".

    Privilege is allowed if the "ALL" privilege is found in "allow".
    Privilege is denied if the "ALL" privilege is found in "deny".

    Otherwise, privilege is granted.


The keyword "ALL" can stand for all security codes, for all privileges, and
for all users. Therefore, a single user system for Mack can be setup like:

    secure all
    deny all all
    allow all mack