Skip to content

Commit d290ecd

Browse files
mnoconjulitafalcondusza
mnocon
and
julitafalcondusza
committed
[Discounts] Discount policies (#2771)
* Permissions * Build fixes * Fixed links * Fixed last links * Removed link * Apply suggestions from code review Co-authored-by: julitafalcondusza <[email protected]> --------- Co-authored-by: julitafalcondusza <[email protected]>
1 parent df345d6 commit d290ecd

File tree

4 files changed

+56
-11
lines changed

4 files changed

+56
-11
lines changed

‎docs/administration/recent_activity/recent_activity.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ For every exact hour, the cronjob line is:
4343
## Permission and security
4444

4545
The [`activity_log/read`](policies.md#activity-log) policy gives a role the access to the **Admin** -> **Activity list**, the dashboard's **Recent activity** block, and the user profile's **Recent activity**.
46-
It can be limited to "Only own logs" ([`ActivityLogOwner`](limitation_reference.md#activitylogowner-limitation)).
46+
It can be limited to "Only own logs" ([`ActivityLogOwner`](limitation_reference.md#activity-log-owner-limitation)).
4747

4848
The policy should be given to every roles having access to the back office, at least with the `ActivityLogOwner` owner limitation, to allow them to use the "Recent activity" block in the [default dashboard](configure_default_dashboard.md) or their [custom dashboard](customize_dashboard.md).
4949
This policy is required to view [activity log in user profile]([[= user_doc =]]/getting_started/get_started/#view-and-edit-user-profile), if [profile is enabled](update_from_4.5.md#user-profile).

‎docs/permissions/limitation_reference.md

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -33,17 +33,17 @@ Out of the box FunctionList uses it in the following way:
3333
- {name: ibexa.permissions.limitation_type, alias: FunctionList}
3434
```
3535
36-
## ActivityLogOwner limitation
36+
## Activity log Owner limitation
3737
38-
The `ActivityLogOwner` limitation specifies if a user can see only their own [recent activity](recent_activity.md) log entries, and not entries from other users.
38+
The Activity log Owner (`ActivityLogOwner`) limitation specifies if a user can see only their own [recent activity](recent_activity.md) log entries, and not entries from other users.
3939

4040
| Value | UI value | Description |
4141
|-------|-----------------|--------------------------------------------------------------|
4242
| `1` | "Only own logs" | Current user can only access their own activity log entries. |
4343

44-
## CartOwner limitation
44+
## Cart Owner limitation
4545

46-
The `CartOwner` limitation specifies whether the user can modify a cart.
46+
The Cart Owner (`CartOwner`) limitation specifies whether the user can modify a cart.
4747

4848
### Possible values
4949

@@ -62,6 +62,16 @@ The Change Owner (`ChangeOwner`) limitation specifies whether the user can chang
6262
|------|------|------|
6363
|`1`|"Forbid"|The user cannot change owner of a content item|
6464

65+
## Discount Owner limitation [[% include 'snippets/lts-update_badge.md' %]] [[% include 'snippets/commerce_badge.md' %]]
66+
67+
The Discount Owner (`DiscountOwner`) limitation specifies whether the user can interact with a [discount](discounts.md).
68+
69+
### Possible values
70+
71+
|Value|UI value|Description|
72+
|------|------|------|
73+
|"self"|"self"|Only the user who is the owner of the discount gets access.|
74+
6575
## Content type Group limitation
6676

6777
The Content Type Group (`UserGroup`) limitation specifies that only users with at least one common *direct* user group with the owner of content get the selected access right.

‎docs/permissions/permission_use_cases.md

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -269,6 +269,22 @@ Set the following permissions to decide what actions are available when users in
269269
- `checkout/update` - to allow users to modify existing information, for example item quantity
270270
- `checkout/delete` - to delete checkout
271271

272+
### Discount management [[% include 'snippets/lts-update_badge.md' %]]
273+
274+
Set the following permissions to decide what actions are available when users interact with [discounts](discounts.md) in the back office:
275+
276+
- `discount/create` - to allow the user to create a new discount
277+
- `discount/update` - to allow the user to change the parameters of an existing discount
278+
- `discount/view` - to allow the user to view discounts data
279+
- `discount/delete` - to delete an existing discount
280+
- `discount/enable` - to allow the user to enable an existing discount
281+
- `discount/disable` - to allow the user to disable an existing discount
282+
283+
To further control access to a discount, you can use the `DiscountOwner` limitation and set its value to `self`.
284+
This way users can only interact with their own discounts.
285+
286+
Store users do not need any permissions to use discounts in the buying process.
287+
272288
### Order management
273289

274290
Set the following permissions to decide what actions are available when users interact with orders:

‎docs/permissions/policies.md

Lines changed: 25 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -27,9 +27,9 @@ Each role you assign to user or user group consists of policies which define, wh
2727

2828
| Module | Function | Effect | Possible Limitations |
2929
|------------------------------|--------------------|----------------------|-------------------------------------------------------------------------|
30-
| <nobr>`activity_log`</nobr> | <nobr>`read`</nobr> | access activity list | [ActivityLogOwner](limitation_reference.md#activitylogowner-limitation) |
30+
| <nobr>`activity_log`</nobr> | <nobr>`read`</nobr> | access activity list | [ActivityLogOwner](limitation_reference.md#activity-log-owner-limitation) |
3131

32-
#### AI actions
32+
#### AI actions [[% include 'snippets/lts-update_badge.md' %]]
3333

3434
| Module | Function | Effect | Possible Limitations |
3535
|-------------------------------------|------------------------|------------------------|----------------------|
@@ -103,10 +103,10 @@ Each role you assign to user or user group consists of policies which define, wh
103103

104104
| Module | Function | Effect | Possible limitations |
105105
|---------------------|-----------------------|---------------------------------------------------------------------|-----------------------------------------------------------|
106-
| <nobr>`cart`</nobr> | <nobr>`create`</nobr> | create a cart | [CartOwner](limitation_reference.md#cartowner-limitation) |
107-
| | <nobr>`delete`</nobr> | delete cart, for example, after successful checkout | [CartOwner](limitation_reference.md#cartowner-limitation) |
108-
| | <nobr>`edit`</nobr> | change cart metadata (name, currency, owner), add/remove cart items | [CartOwner](limitation_reference.md#cartowner-limitation) |
109-
| | <nobr>`view`</nobr> | view a cart | [CartOwner](limitation_reference.md#cartowner-limitation) |
106+
| <nobr>`cart`</nobr> | <nobr>`create`</nobr> | create a cart | [CartOwner](limitation_reference.md#cart-owner-limitation) |
107+
| | <nobr>`delete`</nobr> | delete cart, for example, after successful checkout | [CartOwner](limitation_reference.md#cart-owner-limitation) |
108+
| | <nobr>`edit`</nobr> | change cart metadata (name, currency, owner), add/remove cart items | [CartOwner](limitation_reference.md#cart-owner-limitation) |
109+
| | <nobr>`view`</nobr> | view a cart | [CartOwner](limitation_reference.md#cart-owner-limitation) |
110110

111111
#### Checkout [[% include 'snippets/commerce_badge.md' %]]
112112

@@ -124,6 +124,25 @@ Each role you assign to user or user group consists of policies which define, wh
124124
| <nobr>`commerce`</nobr> | <nobr>`currency`</nobr> | manage currencies |
125125
| | <nobr>`region`</nobr> | manage regions |
126126

127+
#### Discounts [[% include 'snippets/lts-update_badge.md' %]] [[% include 'snippets/commerce_badge.md' %]]
128+
129+
The discount policies decide which actions can be executed by given user or user group.
130+
131+
!!! caution "Customers and discount policies"
132+
133+
Customers don't need any policies to use the discounts on the [storefront](storefront.md).
134+
Even the `discount/view` policy would allow them to access all the discount details, including the coupon codes to activate them, which could lead to system abuse.
135+
136+
137+
| Module | Function | Effect | Possible limitations |
138+
|----------------------|--------------------------|-----------------------------|----------------------------------------------------|
139+
| <nobr>`discount`</nobr> | <nobr>`create`</nobr> | create a discount | [DiscountOwner](limitation_reference.md#discount-owner-limitation) |
140+
| | <nobr>`update`</nobr> | modify discount parameters | [DiscountOwner](limitation_reference.md#discount-owner-limitation) |
141+
| | <nobr>`view`</nobr> | view discounts (including its details) | [DiscountOwner](limitation_reference.md#discount-owner-limitation) |
142+
| | <nobr>`delete`</nobr> | delete a discount | [DiscountOwner](limitation_reference.md#discount-owner-limitation) |
143+
| | <nobr>`enable`</nobr> | enable a discount | [DiscountOwner](limitation_reference.md#discount-owner-limitation) |
144+
| | <nobr>`disable`</nobr> | disable a discount | [DiscountOwner](limitation_reference.md#discount-owner-limitation) |
145+
127146
#### Orders [[% include 'snippets/commerce_badge.md' %]]
128147

129148
| Module | Function | Effect | Possible limitations |

0 commit comments

Comments
 (0)