%# BEGIN BPS TAGGED BLOCK {{{ %# %# COPYRIGHT: %# %# This software is Copyright (c) 1996-2025 Best Practical Solutions, LLC %# <sales@bestpractical.com> %# %# (Except where explicitly superseded by other copyright notices) %# %# %# LICENSE: %# %# This work is made available to you under the terms of Version 2 of %# the GNU General Public License. A copy of that license should have %# been provided with this software, but in any event can be snarfed %# from www.gnu.org. %# %# This work is distributed in the hope that it will be useful, but %# WITHOUT ANY WARRANTY; without even the implied warranty of %# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU %# General Public License for more details. %# %# You should have received a copy of the GNU General Public License %# along with this program; if not, write to the Free Software %# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA %# 02110-1301 or visit their web page on the internet at %# http://www.gnu.org/licenses/old-licenses/gpl-2.0.html. %# %# %# CONTRIBUTION SUBMISSION POLICY: %# %# (The following paragraph is not intended to limit the rights granted %# to you to modify and distribute this software under the terms of %# the GNU General Public License and is only of importance to you if %# you choose to contribute your changes and enhancements to the %# community by submitting them to Best Practical Solutions, LLC.) %# %# By intentionally submitting any modifications, corrections or %# derivatives to this work, or any other work intended for use with %# Request Tracker, to Best Practical Solutions, LLC, you confirm that %# you are the copyright holder for those contributions and you grant %# Best Practical Solutions, LLC a nonexclusive, worldwide, irrevocable, %# royalty-free, perpetual, license to use, copy, create derivative %# works based on those contributions, and sublicense and distribute %# those contributions and any derivatives thereof. %# %# END BPS TAGGED BLOCK }}} <& /Admin/Elements/Header, Title => loc("Rights Inspector") &> <& /Elements/Tabs &>
<&| /Widgets/TitleBox, title => loc('Usage Help') &>

The Rights Inspector lets you search your configured permissions based on several different criteria. Each permission consists of a "Principal" (which user, group, or role has the permission), an "Object" (what record they have permissions on), and a "Right" (the name of the permission). Rights Inspector lets you filter your permissions for any combination of those three.

The "Right" field lets you specify partial and/or multiple rights (e.g. searching `Ticket` will match both "ShowTicket" and "ModifyTicket", while `ShowAsset ShowCatalog` will show results for both rights). Since "SuperUser" provides every other right, it will also be included in results when applicable.

The "Principal" and "Object" search fields by default work based on filtering. For example typing Principal `arch` will show permissions granted to the user "Archibald", the Group "Monarchs", the custom role "Researcher", and so on. You can also filter using other RT concepts by providing search terms like `user`, `article`, and so on.

Alternatively, these two search fields support a special mode where you may specify a unique record directly using syntax like `group:Sales`. This will show recursive memberships (such as rights granted to any groups that the Sales group is a member of). It will also show rights granted by being a member of an individual ticket's or asset's role groups. Similarly, searching for a specific ticket with syntax like `t:10` will show you the permissions for that single ticket and its queue.

Any word prefixed with a `!` will be filtered out from the search results, for example searching for right `ShowTicket !SuperUser`.

For example, to help answer the question "why can Joe see asset #39?" you may specify principal `user:Joe`, object `asset #39`, right `ShowAsset`. This will produce multiple results if Joe has access due to multiple different reasons.

<&|/Widgets/TitleBox, title => loc("Rights Inspector") &>
<& /Widgets/Spinner &>
<%INIT> unless ($session{'CurrentUser'}->HasRight( Object=> RT->System, Right => 'SuperUser')) { Abort(loc('This feature is only available to system administrators.')); }