add acl to idx management in Odmdb

apxtri/models/Odmdb.js

@@ -544,6 +544,76 @@ Odmdb.accessright = (apxaccessrights, role, properties) => {
   });
   return accessright;
 };
+
+Odmdb.getIndexAccess = (objectPathname, indexName) => {
+  const normalized = String(indexName || "")
+    .replace(/\.json$/, "")
+    .trim();
+  if (!/^[A-Za-z0-9_-]+$/.test(normalized)) {
+    return {
+      status: 404,
+      ref: "Odmdb",
+      msg: "indexnotdeclared",
+      data: { indexname: normalized, objectPathname },
+    };
+  }
+  let getschema;
+  try {
+    getschema = Odmdb.Schema(objectPathname, true);
+  } catch (err) {
+    return {
+      status: 500,
+      ref: "Odmdb",
+      msg: "schemainvalid",
+      data: { objectPathname, error: err.message },
+    };
+  }
+  if (getschema.status != 200) return getschema;
+  const indexes = (getschema.data.schema.apxidx || []).filter(
+    (idx) => idx.name === normalized
+  );
+  if (indexes.length == 0) {
+    return {
+      status: 404,
+      ref: "Odmdb",
+      msg: "indexnotdeclared",
+      data: { indexname: normalized, objectPathname },
+    };
+  }
+  if (indexes.length > 1) {
+    return {
+      status: 403,
+      ref: "Odmdb",
+      msg: "indexambiguous",
+      data: { indexname: normalized, objectPathname },
+    };
+  }
+  const index = indexes[0];
+  const acl =
+    index.apxaccess && Array.isArray(index.apxaccess.R)
+      ? index.apxaccess.R
+      : [];
+  return {
+    status: 200,
+    ref: "Odmdb",
+    msg: "indexaccess",
+    data: {
+      indexname: normalized,
+      acl,
+    },
+  };
+};
+
+Odmdb.indexAllowed = (indexaccess, role) => {
+  const acl =
+    indexaccess && Array.isArray(indexaccess.acl) ? indexaccess.acl : [];
+  if (acl.length == 0) return false;
+  if (acl.includes("*")) return true;
+  const profils =
+    role && Array.isArray(role.xprofils) ? role.xprofils : [];
+  return profils.some((profil) => acl.includes(profil));
+};
+
 /**
  * CUD a data itm into objectPathname if checkJson is valid
  *  and update idx

apxtri/routes/odmdb.js

@@ -105,13 +105,14 @@ router.get(
  * @api {get} adminapi/odmdb/idx/:tribe/:objectname/:indexname - index Get
  * @apiGroup Odmdb
  * @apiName getIndexbyindexname
- * @apiDescription Get index file for an object
+ * @apiDescription Get index file for an object. Access is controlled by the index apxaccess.R profiles. Authentication is always required.
  *
  * @apiParams {string} tribe if common adminapi or tribename 
  * @apiParams {string} objectname  If in conf.nationObjects then object is into nationchains/ else in tribes/xtribe/objectname/idx/indexname indexname
  * @apiParams {String} indexname  name of index file in /idx/indexnamme.json 
  *
  * 
+ * @apiError {json} profilnotallow the authenticated user profile cannot read this index
  * @apiError {json} objectNotfound the file does not exist 
  * @apiErrorExample {json}
  * HTTP/1.1 404 Not Found
@@ -127,25 +128,71 @@ router.get(
   checkHeaders,
   isAuthenticated,
   (req, res) => {
-    console.log("passe");
+    const tribeids = Array.isArray(req.app.locals.tribeids)
-    const indexpath = `../${req.params.tribe}/objects/${req.params.objectname}/idx/${req.params.indexname}`;
+      ? req.app.locals.tribeids
-    console.log(indexpath);
+      : [];
-    if (fs.existsSync(indexpath)) {
+    if (
-      res.status(200).json({
+      !["town", "adminapi", ...tribeids].includes(req.params.tribe) ||
+      !/^[A-Za-z0-9_-]+$/.test(req.params.objectname)
+    ) {
+      return res.status(404).json({
+        status: 404,
         ref: "Odmdb",
-        msg: "indexexist",
+        msg: "pathnamedoesnotexist",
         data: {
-          indexname: req.params.indexname,
+          tribe: req.params.tribe,
-          content: fs.readJsonSync(indexpath),
+          objectname: req.params.objectname,
         },
       });
-    } else {
+    }
-      res.status(404).json({
+    const objectPathname = `../${req.params.tribe}/objects/${req.params.objectname}`;
+    const indexaccess = Odmdb.getIndexAccess(
+      objectPathname,
+      req.params.indexname
+    );
+    if (indexaccess.status != 200) {
+      return res.status(indexaccess.status).json(indexaccess);
+    }
+    if (!Odmdb.indexAllowed(indexaccess.data, req.session.header)) {
+      return res.status(403).json({
+        status: 403,
+        ref: "Odmdb",
+        msg: "profilnotallow",
+        data: {
+          indexname: indexaccess.data.indexname,
+          profils: req.session.header.xprofils,
+        },
+      });
+    }
+    const indexpath = `../${req.params.tribe}/objects/${req.params.objectname}/idx/${indexaccess.data.indexname}.json`;
+    if (!fs.existsSync(indexpath)) {
+      return res.status(404).json({
+        status: 404,
         ref: "Odmdb",
         msg: "pathnamedoesnotexist",
         data: { indexpath },
       });
     }
+    let content;
+    try {
+      content = fs.readJsonSync(indexpath);
+    } catch (err) {
+      return res.status(500).json({
+        status: 500,
+        ref: "Odmdb",
+        msg: "indexinvalid",
+        data: { indexpath, error: err.message },
+      });
+    }
+    res.status(200).json({
+      status: 200,
+      ref: "Odmdb",
+      msg: "indexexist",
+      data: {
+        indexname: indexaccess.data.indexname,
+        content,
+      },
+    });
   }
 );
 

schema/articles.json

@@ -149,12 +149,22 @@
     {
       "name": "lst_articleid",
       "type": "array",
-      "keyval": "articleid"
+      "keyval": "articleid",
+      "apxaccess": {
+        "R": [
+          "*"
+        ]
+      }
     },
     {
       "name": "lst_author",
       "type": "array",
-      "keyval": "author"
+      "keyval": "author",
+      "apxaccess": {
+        "R": [
+          "*"
+        ]
+      }
     },
     {
       "name": "articleid",
@@ -173,19 +183,34 @@
         "manualkeywords",
         "autokeywords"
       ],
-      "filter": ""
+      "filter": "",
+      "apxaccess": {
+        "R": [
+          "*"
+        ]
+      }
     },
     {
       "name": "author_articleid",
       "type": "distribution",
       "keyval": "author",
-      "filter": ""
+      "filter": "",
+      "apxaccess": {
+        "R": [
+          "*"
+        ]
+      }
     },
     {
       "name": "manualkeywords_articleid",
       "type": "distribution",
       "keyval": "manualkeywords",
-      "filter": ""
+      "filter": "",
+      "apxaccess": {
+        "R": [
+          "*"
+        ]
+      }
     }
   ],
   "apxaccessrights": {

schema/contracts.json

@@ -20,7 +20,12 @@
       "title": "Contract status",
       "description": "todo = pending execution, done = successfully executed, error = failed, cancelled = manually stopped",
       "type": "string",
-      "enum": ["todo", "done", "error", "cancelled"]
+      "enum": [
+        "todo",
+        "done",
+        "error",
+        "cancelled"
+      ]
     },
     "tribe": {
       "title": "Tribe",
@@ -131,17 +136,32 @@
     {
       "name": "lst_contractid",
       "type": "array",
-      "keyval": "contractid"
+      "keyval": "contractid",
+      "apxaccess": {
+        "R": [
+          "druid"
+        ]
+      }
     },
     {
       "name": "lst_owner",
       "type": "array",
-      "keyval": "owner"
+      "keyval": "owner",
+      "apxaccess": {
+        "R": [
+          "druid"
+        ]
+      }
     },
     {
       "name": "lst_tribe",
       "type": "array",
-      "keyval": "tribe"
+      "keyval": "tribe",
+      "apxaccess": {
+        "R": [
+          "druid"
+        ]
+      }
     },
     {
       "name": "contractid",
@@ -169,7 +189,12 @@
         "dt_create",
         "dt_update"
       ],
-      "filter": ""
+      "filter": "",
+      "apxaccess": {
+        "R": [
+          "druid"
+        ]
+      }
     },
     {
       "name": "status_scheduledDay",
@@ -187,19 +212,34 @@
         "payload",
         "owner"
       ],
-      "filter": "status=todo"
+      "filter": "status=todo",
+      "apxaccess": {
+        "R": [
+          "druid"
+        ]
+      }
     },
     {
       "name": "tribe_status",
       "type": "distribution",
       "keyval": "tribe",
-      "filter": "status"
+      "filter": "status",
+      "apxaccess": {
+        "R": [
+          "druid"
+        ]
+      }
     },
     {
       "name": "status_contractid",
       "type": "distribution",
       "keyval": "status",
-      "filter": ""
+      "filter": "",
+      "apxaccess": {
+        "R": [
+          "druid"
+        ]
+      }
     }
   ],
   "apxaccessrights": {

schema/devices.json

@@ -56,7 +56,8 @@
         "mobile",
         "windows",
         "mac",
-        "linux",""
+        "linux",
+        ""
       ]
     },
     "ip": {
@@ -109,14 +110,19 @@
         "type",
         "os"
       ],
-      "filter": ""
+      "filter": "",
+      "apxaccess": {
+        "R": [
+          "*"
+        ]
+      }
     }
   ],
   "apxaccessrights": {
-    "anonymous":{
+    "anonymous": {
-      "C":[],
+      "C": [],
-      "U":[],
+      "U": [],
-      "D":[]
+      "D": []
     },
     "mayor": {
       "R": []

schema/frenchlocation.json

@@ -14,10 +14,10 @@
       "title": "Type of result found, housenumber is a physical adresse, street position at street, locality: lieud it, municipality",
       "type": "string"
     },
-    "nicknameplace":{
+    "nicknameplace": {
-      "title":"Lacation name for common people",
+      "title": "Lacation name for common people",
-      "description":"This nicknameplace is the common people naming of the place, like 'Sephora Champs elysee' or 'place de la ferme' or 'les bois brulés'",
+      "description": "This nicknameplace is the common people naming of the place, like 'Sephora Champs elysee' or 'place de la ferme' or 'les bois brulés'",
-      "type":"string"
+      "type": "string"
     },
     "housenumber": {
       "title": "number with ince bis ter A B",
@@ -57,13 +57,13 @@
       "properties": {
         "latitude": {
           "type": "number",
-          "minimum": -90.0,
+          "minimum": -90,
-          "maximum": 90.0
+          "maximum": 90
         },
         "longitude": {
           "type": "number",
-          "minimum": -180.0,
+          "minimum": -180,
-          "maximum": 180.0
+          "maximum": 180
         }
       }
     },
@@ -85,7 +85,12 @@
     {
       "name": "lst_locationid",
       "type": "array",
-      "keyval": "locationid"
+      "keyval": "locationid",
+      "apxaccess": {
+        "R": [
+          "*"
+        ]
+      }
     },
     {
       "name": "frenchlocation",
@@ -96,7 +101,12 @@
         "city",
         "label"
       ],
-      "filter": ""
+      "filter": "",
+      "apxaccess": {
+        "R": [
+          "*"
+        ]
+      }
     }
   ],
   "apxaccessrights": {

schema/nations.json

@@ -1,39 +1,68 @@
 {
-  "$schema":"http://json-schema.org/schema#",
+  "$schema": "http://json-schema.org/schema#",
-  "$id":"adminapi/schema/nations",
+  "$id": "adminapi/schema/nations",
   "title": "Nation definition",
   "description": "A nation from apxtri world",
-  "$comment":"see ./lg/nations_lg.json for description in your languange lg",
+  "$comment": "see ./lg/nations_lg.json for description in your languange lg",
   "type": "object",
   "properties": {
     "nationId": {
-      "title":"Unique nation name",
+      "title": "Unique nation name",
-      "description":"A unique string that define a nation a-z and 0-9 onlyin a social world",
+      "description": "A unique string that define a nation a-z and 0-9 onlyin a social world",
       "type": "string",
-      "pattern":"^[a-z0-9]*$"
+      "pattern": "^[a-z0-9]*$"
     },
     "dtcreate": {
-      "title":"Creation date",
+      "title": "Creation date",
-      "description":"Nation date of creation",
+      "description": "Nation date of creation",
       "type": "string",
-      "format":"date-time"
+      "format": "date-time"
     },
-    "contracts":{
+    "contracts": {
-      "title":"Social contract of the nation",
+      "title": "Social contract of the nation",
-      "description":"A uri of the signed js contract that rules this nation",
+      "description": "A uri of the signed js contract that rules this nation",
       "type": "string",
-      "format":"uri"
+      "format": "uri"
     }
   },
-  "required": ["nationId", "dtcreate","contracts"],
+  "required": [
-  "additionalProperties":false,
+    "nationId",
-  "apxid":"nationId",
+    "dtcreate",
-  "apxuniquekey":["nationId"],
+    "contracts"
-  "apxidx": [
-    { "name":"lst_nationId","type":"array","keyval": "nationId"},
-    { "name":"nations","type":"view","keyval":"nationId","objkey":[],"filter":""}
   ],
-  "apxaccessrights":{
+  "additionalProperties": false,
-    "pagan":{"C":[],"R":[]}
+  "apxid": "nationId",
+  "apxuniquekey": [
+    "nationId"
+  ],
+  "apxidx": [
+    {
+      "name": "lst_nationId",
+      "type": "array",
+      "keyval": "nationId",
+      "apxaccess": {
+        "R": [
+          "*"
+        ]
+      }
+    },
+    {
+      "name": "nations",
+      "type": "view",
+      "keyval": "nationId",
+      "objkey": [],
+      "filter": "",
+      "apxaccess": {
+        "R": [
+          "*"
+        ]
+      }
+    }
+  ],
+  "apxaccessrights": {
+    "pagan": {
+      "C": [],
+      "R": []
+    }
   }
 }

schema/pagans.json

@@ -30,23 +30,62 @@
       "type": "string"
     }
   },
-  "required": ["publickey", "alias"],
+  "required": [
+    "publickey",
+    "alias"
+  ],
   "apxid": "alias",
-  "apxuniquekey": ["publickey"],
+  "apxuniquekey": [
+    "publickey"
+  ],
   "apxidx": [
-    { "name": "lst_alias", "type": "array", "keyval": "alias" },
+    {
+      "name": "lst_alias",
+      "type": "array",
+      "keyval": "alias",
+      "apxaccess": {
+        "R": [
+          "*"
+        ]
+      }
+    },
     {
       "name": "alias",
       "type": "view",
       "keyval": "alias",
-      "objkey": [],
+      "objkey": [
-      "filter": ""
+        "alias",
+        "publickey"
+      ],
+      "filter": "",
+      "apxaccess": {
+        "R": [
+          "*"
+        ]
+      }
     }
   ],
   "apxaccessrights": {
-    "owner": { "R": [], "U": [], "D": [] },
+    "owner": {
-    "anonymous": { "C": [], "R": ["alias"] },
+      "R": [],
-    "pagans": { "R": ["alias", "publickey"] },
+      "U": [],
-    "mayor": { "R": [], "D": [] }
+      "D": []
+    },
+    "anonymous": {
+      "C": [],
+      "R": [
+        "alias"
+      ]
+    },
+    "pagans": {
+      "R": [
+        "alias",
+        "publickey"
+      ]
+    },
+    "mayor": {
+      "R": [],
+      "D": []
+    }
   }
 }

schema/persons.json

@@ -1,185 +1,238 @@
 {
-    "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
-    "$id": "/schema/persons",
+  "$id": "/schema/persons",
-    "title": "Person minimum definition to link a person to a pagan identity",
+  "title": "Person minimum definition to link a person to a pagan identity",
-    "description": "A person is a human with a apxtri identity (alias = Public Private Key) that accept to be part of a tribe (a person is store inside a tribe). Information stored for a person are only visible from the town's Mayor and the tribe's Druid. You need at least trust the druid that trust the mayor (for sensitive data Mayor and Druid can be the same apx Identity.) Only a pagan that have the privateKey can read cipher data. The purpose of this schema is to link a person to a tribe and manage basic activities, profil for specific purpose will be a tribe object that can be add additionalProperties of this is set at true.",
+  "description": "A person is a human with a apxtri identity (alias = Public Private Key) that accept to be part of a tribe (a person is store inside a tribe). Information stored for a person are only visible from the town's Mayor and the tribe's Druid. You need at least trust the druid that trust the mayor (for sensitive data Mayor and Druid can be the same apx Identity.) Only a pagan that have the privateKey can read cipher data. The purpose of this schema is to link a person to a tribe and manage basic activities, profil for specific purpose will be a tribe object that can be add additionalProperties of this is set at true.",
-    "type": "object",
+  "type": "object",
-    "properties": {
+  "properties": {
-      "alias": {
+    "alias": {
-        "title": "alias",
+      "title": "alias",
-        "description": "A unique string identifying a unique public key",
+      "description": "A unique string identifying a unique public key",
-        "type": "string",
+      "type": "string",
-        "options": { "$ref": "adminapi/objects/pagans/idx/lst_alias" }
+      "options": {
-      },
+        "$ref": "adminapi/objects/pagans/idx/lst_alias"
-      "owner": {
-        "title": "Owner of this person",
-        "description": "For accessright purpose this is always equal as alias",
-        "type": "string",
-        "options": { "$ref": "adminapi/objects/pagans/idx/lst_alias" }
-      },
-      "dt_create": {
-        "title": "Creation date",
-        "type": "string",
-        "format": "date-time"
-      },
-      "dt_update": {
-        "type": "string",
-        "format": "date-time"
-      },
-      "dt_lastlogin": {
-        "title": "Last time login",
-        "description": "Last time this person authentify as alias access to this tribe",
-        "type": "string",
-        "format": "date-time"
-      },
-      "dt_delete": {
-        "title": "Date of leaving tribe",
-        "description": "Date from when this alias is ban of tribe by druid or want to leave. A pocess of data cleaning has to be run depending of Tribe's rules.",
-        "type": "string",
-        "format": "date"
-      },
-      "will": {
-        "title": "Will script after leaving tribe",
-        "description": "This will script will be apply on your data 30 days after your delete",
-        "type": "string"
-      },
-      "dt_birth": {
-        "title": "Your birthdate",
-        "description": "Date of birth you want to communicate",
-        "type": "string",
-        "format": "date"
-      },
-      "emailcom": {
-        "title": "email use to communicate with you",
-        "description": "email used by tribe to communicate with you, depending of your profil you can also define other mail to interact with other person",
-        "type": "string",
-        "format": "email"
-      },
-      "hobbies": {
-        "title": "My hobbies",
-        "type": "array",
-        "comment": "from a tree word combinaison /lg/hobbies_xx"
-      },
-      "biography": {
-        "title": "Your bio or few words to define yourself",
-        "description": "Use this to share your values, this will be public to all of tribe's members and link to your person",
-        "type": "string",
-        "pattern": "^.{0,1000}$"
-      },
-      "imgbase64_imgavatar": {
-        "title": "Temporary img to update or create",
-        "description": "image will be store in /objects/persons/{alias}_imgavatar.webp",
-        "sizeHW": [80, 80],
-        "type": "string",
-        "format": "imgbase64"
-      },
-      "imgavatar": {
-        "title": "A picture of your person or personnality",
-        "description": "This picture will be public to all tribe's member",
-        "type": "string",
-        "format": "uri"
-      },
-      "profils": {
-        "title": "Array of profil",
-        "description": "List of profil to get accessright on object",
-        "type": "array",
-        "items": {
-          "type": "string",
-          "options": { "$ref": "smatchit/objects/options/profil" }
-        }
       }
     },
-    "required": ["alias", "profils"],
+    "owner": {
-    "additionalProperties": true,
+      "title": "Owner of this person",
-    "apxref": [],
+      "description": "For accessright purpose this is always equal as alias",
-    "apxid": "alias",
+      "type": "string",
-    "apxuniquekey": ["alias"],
+      "options": {
-    "apxidx": [
+        "$ref": "adminapi/objects/pagans/idx/lst_alias"
-      {
-        "name": "lst_alias",
-        "type": "array",
-        "keyval": "alias"
-      },
-      {
-        "name": "lst_profils",
-        "type": "array",
-        "keyval": "profils"
-      },
-      {
-        "name": "alias",
-        "type": "view",
-        "keyval": "alias",
-        "objkey": [
-          "alias",
-          "dt_create",
-          "dt_update",
-          "last_login",
-          "dt_birth",
-          "emailcom",
-          "hobbies",
-          "biography",
-          "imgavatar",
-          "profils"
-        ],
-        "filter": ""
-      },
-      {
-        "name": "profils_alias",
-        "type": "distribution",
-        "keyval": "profils",
-        "filter": ""
-      },
-      {
-        "name": "emailcom_alias",
-        "type": "distribution",
-        "keyval": "emailcom",
-        "filter": ""
-      },
-      {
-        "name": "hobbies_alias",
-        "type": "distribution",
-        "keyval": "hobbies",
-        "filter": ""
       }
-    ],
+    },
-    "commentaccessrights": "only a pagans can create a persons by joining the tribe smatchit. An adminrecruiters can Read person and update only profil by adding value recruiters or interviewers, that will create for this alias a recruiters itm or interviewers itm, use /api/smatchit/profilmanagers/join/:profils/:recruiteralias",
+    "dt_create": {
-    "apxaccessrights": {
+      "title": "Creation date",
-      "owner": {
+      "type": "string",
-        "D": [],
+      "format": "date-time"
-        "R": [
+    },
-          "alias",
+    "dt_update": {
-          "owner",
+      "type": "string",
-          "profils",
+      "format": "date-time"
-          "dt_create",
+    },
-          "dt_update",
+    "dt_lastlogin": {
-          "dt_lastlogin",
+      "title": "Last time login",
-          "dt_birth",
+      "description": "Last time this person authentify as alias access to this tribe",
-          "emailcom",
+      "type": "string",
-          "hobbies",
+      "format": "date-time"
-          "biography",
+    },
-          "imgavatar",
+    "dt_delete": {
-          "profils"
+      "title": "Date of leaving tribe",
-        ],
+      "description": "Date from when this alias is ban of tribe by druid or want to leave. A pocess of data cleaning has to be run depending of Tribe's rules.",
-        "U": [
+      "type": "string",
-          "dt_birth",
+      "format": "date"
-          "emailcom",
+    },
-          "hobbies",
+    "will": {
-          "biography",
+      "title": "Will script after leaving tribe",
-          "imgavatar",
+      "description": "This will script will be apply on your data 30 days after your delete",
-          "profils"
+      "type": "string"
-        ]
+    },
-      },
+    "dt_birth": {
-      "pagans": {
+      "title": "Your birthdate",
-        "C": []
+      "description": "Date of birth you want to communicate",
-      },
+      "type": "string",
-      "mayors": {
+      "format": "date"
-        "D": [],
+    },
-        "R": ["alias"]
+    "emailcom": {
-      },
+      "title": "email use to communicate with you",
-      "druids": {
+      "description": "email used by tribe to communicate with you, depending of your profil you can also define other mail to interact with other person",
-        "D": [],
+      "type": "string",
-        "R": ["alias"]
+      "format": "email"
+    },
+    "hobbies": {
+      "title": "My hobbies",
+      "type": "array",
+      "comment": "from a tree word combinaison /lg/hobbies_xx"
+    },
+    "biography": {
+      "title": "Your bio or few words to define yourself",
+      "description": "Use this to share your values, this will be public to all of tribe's members and link to your person",
+      "type": "string",
+      "pattern": "^.{0,1000}$"
+    },
+    "imgbase64_imgavatar": {
+      "title": "Temporary img to update or create",
+      "description": "image will be store in /objects/persons/{alias}_imgavatar.webp",
+      "sizeHW": [
+        80,
+        80
+      ],
+      "type": "string",
+      "format": "imgbase64"
+    },
+    "imgavatar": {
+      "title": "A picture of your person or personnality",
+      "description": "This picture will be public to all tribe's member",
+      "type": "string",
+      "format": "uri"
+    },
+    "profils": {
+      "title": "Array of profil",
+      "description": "List of profil to get accessright on object",
+      "type": "array",
+      "items": {
+        "type": "string",
+        "options": {
+          "$ref": "smatchit/objects/options/profil"
+        }
       }
     }
+  },
+  "required": [
+    "alias",
+    "profils"
+  ],
+  "additionalProperties": true,
+  "apxref": [],
+  "apxid": "alias",
+  "apxuniquekey": [
+    "alias"
+  ],
+  "apxidx": [
+    {
+      "name": "lst_alias",
+      "type": "array",
+      "keyval": "alias",
+      "apxaccess": {
+        "R": [
+          "mayors",
+          "druids"
+        ]
+      }
+    },
+    {
+      "name": "lst_profils",
+      "type": "array",
+      "keyval": "profils",
+      "apxaccess": {
+        "R": [
+          "mayors",
+          "druids"
+        ]
+      }
+    },
+    {
+      "name": "alias",
+      "type": "view",
+      "keyval": "alias",
+      "objkey": [
+        "alias",
+        "dt_create",
+        "dt_update",
+        "last_login",
+        "dt_birth",
+        "emailcom",
+        "hobbies",
+        "biography",
+        "imgavatar",
+        "profils"
+      ],
+      "filter": "",
+      "apxaccess": {
+        "R": [
+          "mayors",
+          "druids"
+        ]
+      }
+    },
+    {
+      "name": "profils_alias",
+      "type": "distribution",
+      "keyval": "profils",
+      "filter": "",
+      "apxaccess": {
+        "R": [
+          "mayors",
+          "druids"
+        ]
+      }
+    },
+    {
+      "name": "emailcom_alias",
+      "type": "distribution",
+      "keyval": "emailcom",
+      "filter": "",
+      "apxaccess": {
+        "R": [
+          "mayors",
+          "druids"
+        ]
+      }
+    },
+    {
+      "name": "hobbies_alias",
+      "type": "distribution",
+      "keyval": "hobbies",
+      "filter": "",
+      "apxaccess": {
+        "R": [
+          "mayors",
+          "druids"
+        ]
+      }
+    }
+  ],
+  "commentaccessrights": "only a pagans can create a persons by joining the tribe smatchit. An adminrecruiters can Read person and update only profil by adding value recruiters or interviewers, that will create for this alias a recruiters itm or interviewers itm, use /api/smatchit/profilmanagers/join/:profils/:recruiteralias",
+  "apxaccessrights": {
+    "owner": {
+      "D": [],
+      "R": [
+        "alias",
+        "owner",
+        "profils",
+        "dt_create",
+        "dt_update",
+        "dt_lastlogin",
+        "dt_birth",
+        "emailcom",
+        "hobbies",
+        "biography",
+        "imgavatar",
+        "profils"
+      ],
+      "U": [
+        "dt_birth",
+        "emailcom",
+        "hobbies",
+        "biography",
+        "imgavatar",
+        "profils"
+      ]
+    },
+    "pagans": {
+      "C": []
+    },
+    "mayors": {
+      "D": [],
+      "R": [
+        "alias"
+      ]
+    },
+    "druids": {
+      "D": [],
+      "R": [
+        "alias"
+      ]
+    }
   }
-  
+}

schema/screens.json

@@ -1,69 +1,99 @@
 {
-    "$id": "https://site.smatchit.io/schema/screens",
+  "$id": "https://site.smatchit.io/schema/screens",
-    "$comment": "To describe screens as tree to navigate inside",
+  "$comment": "To describe screens as tree to navigate inside",
-    "title": "Screens description",
+  "title": "Screens description",
-    "description": "Each propertie value is a mustache template string where a data must be provide to display screen with value",
+  "description": "Each propertie value is a mustache template string where a data must be provide to display screen with value",
-    "type": "object",
+  "type": "object",
-    "properties": {
+  "properties": {
-      "screenid":{
+    "screenid": {
-        "title":"Screen identification used in html tag id",
+      "title": "Screen identification used in html tag id",
-        "type":"string"
+      "type": "string"
-      },
-      "title": {
-        "title": "A title in a screen",
-        "type": "string"
-      },
-      "subtitle": {
-        "title": "A subtitle in a screen",
-        "type": "string"
-      },
-      "icon": {
-        "title": "an icon name",
-        "type": "string"
-      },
-      "warning": {
-        "title": "A text to highlight something, this text is between 2 ! icon",
-        "type": "string"
-      },
-      "formcontrol": {
-        "title": "A key word to presents this content",
-        "type": "string",
-        "enum":["squarebluebtn","listbtn","form"]
-      },
-      "forms":{
-        "title":"Liste of data collection element into the screen",
-        "type":"array",
-        "items":{"type":"objects"}
     },
-      "action": {
+    "title": {
-        "title": "List of possible action on this element",
+      "title": "A title in a screen",
-        "type": "string",
+      "type": "string"
-        "enum":["onclick"]
+    },
-      },
+    "subtitle": {
-      "function":{
+      "title": "A subtitle in a screen",
-        "title":"Function name to call, if action",
+      "type": "string"
-        "comment":"other function than nextlevel",
+    },
-        "type":"string"
+    "icon": {
-      },
+      "title": "an icon name",
-      "params":{
+      "type": "string"
-        "title":" an object containning parameter to send to function",
+    },
-        "comment":"can be empty {}",
+    "warning": {
-        "type":"objects"
+      "title": "A text to highlight something, this text is between 2 ! icon",
-      },
+      "type": "string"
-      "nextlevel":{
+    },
-        "title":"List of new screens to show if function is nextlevel $ref:# means it same current schema",
+    "formcontrol": {
-        "type":"array",
+      "title": "A key word to presents this content",
-        "items":{"$ref":"#"}
+      "type": "string",
+      "enum": [
+        "squarebluebtn",
+        "listbtn",
+        "form"
+      ]
+    },
+    "forms": {
+      "title": "Liste of data collection element into the screen",
+      "type": "array",
+      "items": {
+        "type": "objects"
       }
     },
-    "required": ["screenid", "title"],
+    "action": {
-    "apxid": "screenid",
+      "title": "List of possible action on this element",
-    "apxuniquekey": ["screenid"],
+      "type": "string",
-    "apxidx": [
+      "enum": [
-      { "name": "lst_screens", "type": "array", "keyval": "screenid" },
+        "onclick"
-    ],
+      ]
-    "apxaccessrights": {
+    },
-      "owner": { "R": [], "U": [], "D": [] },
+    "function": {
-      "anonymous": { "R": [] },
+      "title": "Function name to call, if action",
+      "comment": "other function than nextlevel",
+      "type": "string"
+    },
+    "params": {
+      "title": " an object containning parameter to send to function",
+      "comment": "can be empty {}",
+      "type": "objects"
+    },
+    "nextlevel": {
+      "title": "List of new screens to show if function is nextlevel $ref:# means it same current schema",
+      "type": "array",
+      "items": {
+        "$ref": "#"
+      }
+    }
+  },
+  "required": [
+    "screenid",
+    "title"
+  ],
+  "apxid": "screenid",
+  "apxuniquekey": [
+    "screenid"
+  ],
+  "apxidx": [
+    {
+      "name": "lst_screens",
+      "type": "array",
+      "keyval": "screenid",
+      "apxaccess": {
+        "R": [
+          "*"
+        ]
+      }
+    }
+  ],
+  "apxaccessrights": {
+    "owner": {
+      "R": [],
+      "U": [],
+      "D": []
+    },
+    "anonymous": {
+      "R": []
     }
   }
+}

schema/towns.json

@@ -61,15 +61,25 @@
   "apxidx": [
     {
       "name": "lst_townId",
-      "type":"array",
+      "type": "array",
-      "keyval": "townId"
+      "keyval": "townId",
+      "apxaccess": {
+        "R": [
+          "*"
+        ]
+      }
     },
     {
       "name": "towns",
       "keyval": "townId",
       "type": "view",
       "objkey": [],
-      "filter": ""
+      "filter": "",
+      "apxaccess": {
+        "R": [
+          "*"
+        ]
+      }
     }
   ],
   "apxaccessrights": {

schema/tribes.json

@@ -52,14 +52,24 @@
     {
       "name": "lst_tribeId",
       "keyval": "tribeId",
-      "type": "array"
+      "type": "array",
+      "apxaccess": {
+        "R": [
+          "*"
+        ]
+      }
     },
     {
       "name": "tribes",
       "keyval": "tribeId",
       "type": "view",
       "objkey": [],
-      "filter": ""
+      "filter": "",
+      "apxaccess": {
+        "R": [
+          "*"
+        ]
+      }
     },
     {
       "name": "owner_tribeId",
@@ -67,7 +77,12 @@
       "keyval": "owner",
       "objkey": [
         "tribeId"
-      ]
+      ],
+      "apxaccess": {
+        "R": [
+          "*"
+        ]
+      }
     },
     {
       "name": "dns_tribeId",
@@ -75,7 +90,12 @@
       "keyval": "dns",
       "objkey": [
         "tribeId"
-      ]
+      ],
+      "apxaccess": {
+        "R": [
+          "*"
+        ]
+      }
     },
     {
       "name": "tribes_dns",
@@ -84,7 +104,12 @@
       "objkey": [
         "dns"
       ],
-      "filter": ""
+      "filter": "",
+      "apxaccess": {
+        "R": [
+          "*"
+        ]
+      }
     }
   ],
   "apxacceesrights": {

schema/wco.json

@@ -18,54 +18,59 @@
       "description": "Code signature of alias publickey",
       "type": "string"
     },
-    "thumbnail":{
+    "thumbnail": {
-      "title":"Thumbnail of the component",
+      "title": "Thumbnail of the component",
-      "type":"string"
+      "type": "string"
     },
-    "title":{
+    "title": {
-      "title":"Short description of the wco",
+      "title": "Short description of the wco",
-      "type":"string"
+      "type": "string"
     },
-    "description":{
+    "description": {
-      "title":"Long description in html of the component",
+      "title": "Long description in html of the component",
-      "type":"string"
+      "type": "string"
     },
-    "tpl":{
+    "tpl": {
-      "description":"list of mustache template to manage components each file must ended by _xx.mustache where xx is the language of the template, so you can add translation easily",
+      "description": "list of mustache template to manage components each file must ended by _xx.mustache where xx is the language of the template, so you can add translation easily",
-      "type":"array"
+      "type": "array"
     },
-    "tpldata":{
+    "tpldata": {
-      "description":"Example of tpldata that you have to add in your local to customize the wco ended by _xx.json where xx is the language of the template",
+      "description": "Example of tpldata that you have to add in your local to customize the wco ended by _xx.json where xx is the language of the template",
-      "type":"array" 
+      "type": "array"
     }
-},
+  },
-"required": [
+  "required": [
-"wconame",
+    "wconame",
-"owner",
+    "owner",
-"title"
+    "title"
-],
+  ],
-"apxid": "wconame",
+  "apxid": "wconame",
-"apxuniquekey": [
+  "apxuniquekey": [
-"wconame"
+    "wconame"
-],
+  ],
-"apxidx": [
+  "apxidx": [
-{
+    {
-  "name": "lst_wconame",
+      "name": "lst_wconame",
-  "type": "array",
+      "type": "array",
-  "keyval": "wconame"
+      "keyval": "wconame",
-}
+      "apxaccess": {
-],
+        "R": [
-"apxaccessrights": {
+          "*"
-"owner": {
+        ]
-  "D": [],
+      }
-  "R": [],
+    }
-  "U": []
+  ],
-},
+  "apxaccessrights": {
-"mayor": {
+    "owner": {
-  "C": []
+      "D": [],
-},
+      "R": [],
-"person": {
+      "U": []
-  "R": []
+    },
-}
+    "mayor": {
-}
+      "C": []
+    },
+    "person": {
+      "R": []
+    }
+  }
 }

schema/wwws.json

@@ -98,7 +98,12 @@
     {
       "name": "lst_website",
       "type": "array",
-      "keyval": "website"
+      "keyval": "website",
+      "apxaccess": {
+        "R": [
+          "*"
+        ]
+      }
     }
   ],
   "apxaccessrights": {