Roles and Access

Access Levels

Anonymous visitor

  • Can access public pages like home/login/register
  • Cannot access parcel workflows that require login

Authenticated user (public user)

  • Can access parcels list/map/search
  • Visibility limited to:
  • own parcels
  • parcels marked is_public=True
  • Can use list/map selection features

Staff user

  • May access Django admin according to Django permissions.
  • Does not gain dataset visibility or workflow authority from is_staff.

Superuser

  • Full Django admin powers
  • Can use setup-groups utility (/auth/admin/setup-groups/)
  • Does not receive dataset roles, an active dataset, or parcel workflow access
  • Must use a separate non-superuser account for dataset operations

Dataset-Aware Scope

Most parcel queries are constrained to the active dataset. This applies to list/map/search/selection/statistics/export/upload workflows.

Dataset Roles

Dataset reads are controlled per dataset for users and groups with this hierarchy:

  • APPROVER (inherits reviewer/editor/viewer)
  • REVIEWER (inherits editor/viewer)
  • EDITOR (inherits viewer)
  • VIEWER

Analytics and reports require at least VIEWER on the active dataset. Existing read and inspection exports keep their documented minimum thresholds.

Effective role is the highest role from:

  • direct user grants
  • group grants through any group the user belongs to

Users without a grant for a dataset cannot access that dataset, even if they manipulate URLs or API requests. Superusers are excluded from dataset roles even if a stale direct grant or group membership exists.

Workflow mutations do not use the hierarchy. They require the exact role for the action: Editor for authoring, Reviewer for submitted-stage decisions, and Approver for reviewed-stage decisions. A user may hold several exact roles through direct and group grants, but a higher role alone never substitutes for a lower mutation role.

The creator or submitter cannot review or reject at the submitted stage. The creator, submitter, or reviewer cannot approve or reject at the reviewed stage. Cancellation remains role-based and does not require item ownership.

Active Dataset Selector

  • Each authenticated user has UserProfile.active_dataset.
  • Selector options include only datasets where the user has at least VIEWER.
  • If the active dataset becomes invalid (revoked/inactive), middleware clears it and auto-selects the first accessible dataset (stable ordering) when possible.
  • Exact mutation grants on an inactive dataset do not authorize actions. The dataset must be active as well as explicitly granted.
  • If no datasets are accessible, dataset-scoped pages return empty/no-access behavior until access is granted.