NAME

WWW::Kontent::Magic::Fidelius - Fidelius access-control system for Kontent

SYNOPSIS

        # Attributes
        fidelius:child=edit(-users/annoying_user) default(any)
        fidelius:self=edit(users/admin1 users/admin2 -any) default(any)

DESCRIPTION

Fidelius is a simple access-control system for Kontent. It allows two attributes to be used to control who can access which modes of which pages.

The first attribute, fidelius:self, controls which users can view the page. Specifically, it allows or denies access to the current user based on the mode. The second attribute, fidelius:child, controls which users can view children of the page; it works by allowing or denying them the ability to resolve child pages based on the mode.

Both attributes are constructed in the same way. The mode is listed, followed by a series of users in parentheses. Users can have a minus sign prefixed to their name, in which case they are specifically blocked from accessing the page. Users who aren't listed are implicitly blocked.

The special mode "all" is checked before any other checks are done; it can be used to list users who should always be allowed or denied access, regardless of later checks. The special mode "default" is checked after the current mode; it can be used to list users who should be allowed access unless they've been specifically blocked. Finally, the special user "any" can be used in any mode (even the special ones) to indicate how users who aren't listed in that mode should be treated. In the future, it is likely that a special user called "owner" will also be supported, although the semantics of it haven't been decided.

There are two conditions under which Fidelius checks will not be performed at all:

• There is no current user. This usually only happens when resolving the current user, but can also happen when tools use the Kontent libraries.

• The appropriate Fidelius attribute (either fidelius:self or fidelius:child) does not exist. Note that this is not the same as the attribute being empty.

ETYMOLOGY

The name "Fidelius" is based on a spell from J.K. Rowling's Harry Potter series called the Fidelius Charm. In the books, the Fidelius Charm is used to control who can disseminate a piece of information; it is similar in some ways to a DRM system, though far more potent and effective.

SEE ALSO

WWW::Kontent, WWW::Kontent::Revision, WWW::Kontent::Store