Who can do what with a file or a label: the one place edms answers it, for its routes and for its listings.
class MMO\edms\helpers\Access
Namespace
MMO\edms\helpers
See
SHARE (put it in labels), and on a label CREATE (put files in it, make labels under it). A scope without an action is every action.
The rights are mmo.oauth scopes, held by the client (or its roles), keyed by id so a rename changes nothing:
- `edms.files.{id}-{ctime}` a file ([`File::scopeID`](https://mcp.mmoframework.fr/documentation/mmo.edms/php/entities/File.md#file-scopeid): its creation time too, as a repository can give the id of a
file deleted to a new one), `edms.labels.{id}` a label and every label under it, `edms.files`/`edms.labels` all
of them, `edms` everything;
- an action narrows it: `edms.labels.12#show`. The actions are [`SHOW`](https://mcp.mmoframework.fr/documentation/mmo.edms/php/helpers/Access.md#access-show), [`EDIT`](https://mcp.mmoframework.fr/documentation/mmo.edms/php/helpers/Access.md#access-edit), [`DELETE`](https://mcp.mmoframework.fr/documentation/mmo.edms/php/helpers/Access.md#access-delete), on a file
A client can do anything with the files it owns and the labels of its own space ([`Label::$owner`](https://mcp.mmoframework.fr/documentation/mmo.edms/php/entities/Label.md#label-owner)). With
another's file, the most precise scope set decides, that is, in order:
1. the file's own (`edms.files.{id}-{ctime}`): it can refuse what a label gives;
2. its labels': any label granting the action is enough -- a label, or the closest of its parents holding a
scope. A folder shared is every file in it. A label refusing it, and none granting it, refuses it. The owner
of a label sees the files put in it, and nothing more;
3. the global ones: `edms.files` for any file, `edms.labels` for any file carrying a label.
Putting a file in labels is sharing it: the owner does, or a client granted [`SHARE`](https://mcp.mmoframework.fr/documentation/mmo.edms/php/helpers/Access.md#access-share) on it ([`canShare`](https://mcp.mmoframework.fr/documentation/mmo.edms/php/helpers/Access.md#access-canshare)) --
never one who can only edit it, who would give it to the labels of its own space.
$user->allow($label->scopeID('show')); // $user sees every file carrying $label, or one of its children
$access->can($user, Access::SHOW, $file); // true
A filter of the files $client can see, for a query to paginate itself: it can hold some $client cannot (a file refusing it, while one of its labels grants it) -- can decides for each.
true if $client can put $file in labels: its owner, or a client granted it (edms.files.{id}-{ctime}#share, edms.files#share...) -- a label's scope never gives it
A filter of the files $client can see, for a query to paginate itself: it can hold some $client cannot (a file refusing it, while one of its labels grants it) -- can decides for each.