acl_setup.php

   1 <?php
   2  // Copyright (C) 2005-2017 Rod Roark <rod@sunsetsystems.com>
   3  //
   4  // This program is free software; you can redistribute it and/or
   5  // modify it under the terms of the GNU General Public License
   6  // as published by the Free Software Foundation; either version 2
   7  // of the License, or (at your option) any later version.
   8  //
   9  // This program is run by the OpenEMR setup.php script to install phpGACL
  10  // and creates the Access Control Objects and their sections.
  11  // See openemr/library/acl.inc file for the list of
  12  // currently supported Access Control Objects(ACO), which this
  13  // script will install.  This script also creates several
  14  // ARO groups, an "admin" ARO, and some reasonable ACL entries for
  15  // the groups.
  16  //   ARO groups include:
  17  //      Administrators
  18  //      Physicians     (Doctors)
  19  //      Clinicians     (Nurses, Physician Assistants, etc.)
  20  //      Front Office   (Receptionist)
  21  //      Accounting
  22  //
  23  // Upgrade Howto
  24  // When upgrading to a new version of OpenEMR, run the acl_upgrade.php
  25  // script to update the phpGACL access controls.  This is required to
  26  // ensure the database includes all the required Access Control
  27  // Objects(ACO).
  28  //
  29
  30  // On 06/2009, added pertinent comments below each entry to allow capture
  31  //  of these terms by the translation engine.
  32
  33  require_once(dirname(__FILE__).'/library/acl.inc');
  34
  35  if (! $phpgacl_location) die("You must first set up library/acl.inc to use phpGACL!");
  36
  37  require_once("$phpgacl_location/gacl_api.class.php");
  38
  39  $gacl = new gacl_api();
  40
  41  // Create the ACO sections.  Every ACO must have a section.
  42  //
  43  if ($gacl->add_object_section('Accounting', 'acct', 10, 0, 'ACO') === FALSE) {
  44   echo "Unable to create the access controls for OpenEMR.  You have likely already run this script (acl_setup.php) successfully.<br>Other possible problems include php-GACL configuration file errors (gacl.ini.php or gacl.class.php).<br>";
  45   return;
  46  }
  47      // xl('Accounting')
  48  $gacl->add_object_section('Administration', 'admin'        , 10, 0, 'ACO');
  49      // xl('Administration')
  50  $gacl->add_object_section('Encounters'    , 'encounters'   , 10, 0, 'ACO');
  51      // xl('Encounters')
  52  $gacl->add_object_section('Lists'         , 'lists'        , 10, 0, 'ACO');
  53      // xl('Lists')
  54  $gacl->add_object_section('Patients'      , 'patients'     , 10, 0, 'ACO');
  55      // xl('Patients')
  56  $gacl->add_object_section('Squads'        , 'squads'       , 10, 0, 'ACO');
  57      // xl('Squads')
  58  $gacl->add_object_section('Sensitivities' , 'sensitivities', 10, 0, 'ACO');
  59      // xl('Sensitivities')
  60  $gacl->add_object_section('Placeholder'   , 'placeholder'  , 10, 0, 'ACO');
  61      // xl('Placeholder')
  62  $gacl->add_object_section('Nation Notes'   , 'nationnotes'  , 10, 0, 'ACO');
  63      // xl('Nation Notes')
  64  $gacl->add_object_section('Patient Portal','patientportal'  , 10, 0, 'ACO');
  65      // xl('Patient Portal')
  66   $gacl->add_object_section('Menus','menus'  , 10, 0, 'ACO');
  67      // xl('Menus')
  68  // Create Accounting ACOs.
  69  //
  70  $gacl->add_object('acct', 'Billing (write optional)'           , 'bill' , 10, 0, 'ACO');
  71      // xl('Billing (write optional)')
  72  $gacl->add_object('acct', 'Price Discounting'                  , 'disc' , 10, 0, 'ACO');
  73      // xl('Price Discounting')
  74  $gacl->add_object('acct', 'EOB Data Entry'                     , 'eob'  , 10, 0, 'ACO');
  75      // xl('EOB Data Entry')
  76  $gacl->add_object('acct', 'Financial Reporting - my encounters', 'rep'  , 10, 0, 'ACO');
  77      // xl('Financial Reporting - my encounters')
  78  $gacl->add_object('acct', 'Financial Reporting - anything'     , 'rep_a', 10, 0, 'ACO');
  79      // xl('Financial Reporting - anything')
  80
  81  // Create Administration ACOs.
  82  //
  83  $gacl->add_object('admin', 'Superuser'                       , 'super'    , 10, 0, 'ACO');
  84      // xl('Superuser')
  85  $gacl->add_object('admin', 'Calendar Settings'               , 'calendar' , 10, 0, 'ACO');
  86      // xl('Calendar Settings')
  87  $gacl->add_object('admin', 'Database Reporting'              , 'database' , 10, 0, 'ACO');
  88      // xl('Database Reporting')
  89  $gacl->add_object('admin', 'Forms Administration'            , 'forms'    , 10, 0, 'ACO');
  90      // xl('Forms Administration')
  91  $gacl->add_object('admin', 'Practice Settings'               , 'practice' , 10, 0, 'ACO');
  92      // xl('Practice Settings')
  93  $gacl->add_object('admin', 'Superbill Codes Administration'  , 'superbill', 10, 0, 'ACO');
  94      // xl('Superbill Codes Administration')
  95  $gacl->add_object('admin', 'Users/Groups/Logs Administration', 'users'    , 10, 0, 'ACO');
  96      // xl('Users/Groups/Logs Administration')
  97  $gacl->add_object('admin', 'Batch Communication Tool'        , 'batchcom' , 10, 0, 'ACO');
  98      // xl('Batch Communication Tool')
  99  $gacl->add_object('admin', 'Language Interface Tool'         , 'language' , 10, 0, 'ACO');
 100      // xl('Language Interface Tool')
 101  $gacl->add_object('admin', 'Pharmacy Dispensary'             , 'drugs'    , 10, 0, 'ACO');
 102      // xl('Pharmacy Dispensary')
 103  $gacl->add_object('admin', 'ACL Administration'              , 'acl'      , 10, 0, 'ACO');
 104      // xl('ACL Administration')
 105
 106  // Create ACOs for encounters.
 107  //
 108  $gacl->add_object('encounters', 'Authorize - my encounters'                        , 'auth'    , 10, 0, 'ACO');
 109      // xl('Authorize - my encounters')
 110  $gacl->add_object('encounters', 'Authorize - any encounters'                       , 'auth_a'  , 10, 0, 'ACO');
 111      // xl('Authorize - any encounters')
 112  $gacl->add_object('encounters', 'Coding - my encounters (write,wsome optional)'    , 'coding'  , 10, 0, 'ACO');
 113      // xl('Coding - my encounters (write,wsome optional)')
 114  $gacl->add_object('encounters', 'Coding - any encounters (write,wsome optional)'   , 'coding_a', 10, 0, 'ACO');
 115      // xl('Coding - any encounters (write,wsome optional)')
 116  $gacl->add_object('encounters', 'Notes - my encounters (write,addonly optional)'   , 'notes'   , 10, 0, 'ACO');
 117      // xl('Notes - my encounters (write,addonly optional)')
 118  $gacl->add_object('encounters', 'Notes - any encounters (write,addonly optional)'  , 'notes_a' , 10, 0, 'ACO');
 119      // xl('Notes - any encounters (write,addonly optional)')
 120  $gacl->add_object('encounters', 'Fix encounter dates - any encounters'             , 'date_a'  , 10, 0, 'ACO');
 121      // xl('Fix encounter dates - any encounters')
 122  $gacl->add_object('encounters', 'Less-private information (write,addonly optional)', 'relaxed' , 10, 0, 'ACO');
 123      // xl('Less-private information (write,addonly optional)')
 124
 125  // Create ACOs for lists.
 126  //
 127  $gacl->add_object('lists', 'Default List (write,addonly optional)'        , 'default'  , 10, 0, 'ACO');
 128      // xl('Default List (write,addonly optional)')
 129  $gacl->add_object('lists', 'State List (write,addonly optional)'          , 'state'    , 10, 0, 'ACO');
 130      // xl('State List (write,addonly optional)')
 131  $gacl->add_object('lists', 'Country List (write,addonly optional)'        , 'country'  , 10, 0, 'ACO');
 132      // xl('Country List (write,addonly optional)')
 133  $gacl->add_object('lists', 'Language List (write,addonly optional)'       , 'language' , 10, 0, 'ACO');
 134      // xl('Language List (write,addonly optional)')
 135  $gacl->add_object('lists', 'Ethnicity-Race List (write,addonly optional)' , 'ethrace'  , 10, 0, 'ACO');
 136      // xl('Ethnicity-Race List (write,addonly optional)')
 137
 138  // Create ACOs for patientportal.
 139  //
 140  $gacl->add_object('patientportal', 'Patient Portal' , 'portal'  , 10, 0, 'ACO');
 141      // xl('Patient Portal')
 142
 143  // Create ACOs for modules.
 144  //
 145  $gacl->add_object('menus', 'Modules' , 'modle'  , 10, 0, 'ACO');
 146      // xl('Modules')
 147
 148  // Create ACOs for patients.
 149  //
 150  $gacl->add_object('patients', 'Appointments (write,wsome optional)'      , 'appt' , 10, 0, 'ACO');
 151      // xl('Appointments (write,wsome optional)')
 152  $gacl->add_object('patients', 'Demographics (write,addonly optional)'    , 'demo' , 10, 0, 'ACO');
 153      // xl('Demographics (write,addonly optional)')
 154  $gacl->add_object('patients', 'Medical/History (write,addonly optional)' , 'med'  , 10, 0, 'ACO');
 155      // xl('Medical/History (write,addonly optional)')
 156  $gacl->add_object('patients', 'Transactions (write optional)'            , 'trans', 10, 0, 'ACO');
 157      // xl('Transactions (write optional)')
 158  $gacl->add_object('patients', 'Documents (write,addonly optional)'       , 'docs' , 10, 0, 'ACO');
 159      // xl('Documents (write,addonly optional)')
 160  $gacl->add_object('patients', 'Patient Notes (write,addonly optional)'   , 'notes', 10, 0, 'ACO');
 161      // xl('Patient Notes (write,addonly optional)')
 162  $gacl->add_object('patients', 'Sign Lab Results (write,addonly optional)', 'sign'  , 10, 0, 'ACO');
 163      // xl('Sign Lab Results (write,addonly optional)')
 164  $gacl->add_object('patients', 'Patient Reminders (write,addonly optional)','reminder', 10, 0, 'ACO');
 165      // xl('Patient Reminders (write,addonly optional)')
 166  $gacl->add_object('patients', 'Clinical Reminders/Alerts (write,addonly optional)','alert', 10, 0, 'ACO');
 167      // xl('Clinical Reminders/Alerts (write,addonly optional)')
 168  $gacl->add_object('patients', 'Disclosures (write,addonly optional)','disclosure', 10, 0, 'ACO');
 169      // xl('Disclosures (write,addonly optional)')
 170  $gacl->add_object('patients', 'Prescriptions (write,addonly optional)','rx', 10, 0, 'ACO');
 171      // xl('Prescriptions (write,addonly optional)')
 172  $gacl->add_object('patients', 'Amendments (write,addonly optional)','amendment', 10, 0, 'ACO');
 173      // xl('Amendments (write,addonly optional)')
 174  $gacl->add_object('patients', 'Lab Results (write,addonly optional)','lab', 10, 0, 'ACO');
 175      // xl('Lab Results (write,addonly optional)')
 176
 177  // Create ACOs for sensitivities.
 178  //
 179  $gacl->add_object('sensitivities', 'Normal', 'normal', 10, 0, 'ACO');
 180      // xl('Normal')
 181  $gacl->add_object('sensitivities', 'High'  , 'high'  , 20, 0, 'ACO');
 182      // xl('High')
 183
 184  // Create ACO for placeholder.
 185  //
 186  $gacl->add_object('placeholder', 'Placeholder (Maintains empty ACLs)', 'filler', 10, 0, 'ACO');
 187      // xl('Placeholder (Maintains empty ACLs)')
 188
 189  // Create ACO for nationnotes.
 190  //
 191  $gacl->add_object('nationnotes', 'Nation Notes Configure', 'nn_configure', 10, 0, 'ACO');
 192      // xl('Nation Notes Configure')
 193
 194  // Create ARO groups.
 195  //
 196  $users = $gacl->add_group('users', 'OpenEMR Users' , 0     , 'ARO');
 197      // xl('OpenEMR Users')
 198  $admin = $gacl->add_group('admin', 'Administrators', $users, 'ARO');
 199      // xl('Administrators')
 200  $clin  = $gacl->add_group('clin' , 'Clinicians'    , $users, 'ARO');
 201      // xl('Clinicians')
 202  $doc   = $gacl->add_group('doc'  , 'Physicians'    , $users, 'ARO');
 203      // xl('Physicians')
 204  $front = $gacl->add_group('front', 'Front Office'  , $users, 'ARO');
 205      // xl('Front Office')
 206  $back  = $gacl->add_group('back' , 'Accounting'    , $users, 'ARO');
 207      // xl('Accounting')
 208 $breakglass  = $gacl->add_group('breakglass' , 'Emergency Login'    , $users, 'ARO');
 209      // xl('Emergency Login')
 210
 211
 212  // Create a Users section for the AROs (humans).
 213  //
 214  $gacl->add_object_section('Users', 'users', 10, 0, 'ARO');
 215      // xl('Users')
 216
 217  // Create the Administrator in the above-created "users" section
 218  // and add him/her to the above-created "admin" group.
 219  // If this script is being used by OpenEMR's setup, then will
 220  //   incorporate the installation values. Otherwise will
 221 //    hardcode the 'admin' user.
 222  if (isset($this) && isset($this->iuser)) {
 223   $gacl->add_object('users', $this->iuname, $this->iuser, 10, 0, 'ARO');
 224   $gacl->add_group_object($admin, 'users', $this->iuser, 'ARO');
 225  }
 226  else {
 227   $gacl->add_object('users', 'Administrator', 'admin' ,10, 0, 'ARO');
 228   $gacl->add_group_object($admin, 'users', 'admin', 'ARO');
 229  }
 230
 231  // Declare return terms for language translations
 232  //  xl('write') xl('wsome') xl('addonly') xl('view')
 233
 234  // Set permissions for administrators.
 235  //
 236  $gacl->add_acl(
 237   array(
 238    'acct'=>array('bill', 'disc', 'eob', 'rep', 'rep_a'),
 239    'admin'=>array('calendar', 'database', 'forms', 'practice', 'superbill', 'users', 'batchcom', 'language', 'super', 'drugs', 'acl'),
 240    'encounters'=>array('auth_a', 'coding_a', 'notes_a', 'date_a'),
 241    'lists'=>array('default','state','country','language','ethrace'),
 242    'patients'=>array('appt', 'demo', 'med', 'trans', 'docs', 'notes'),
 243    'sensitivities'=>array('normal', 'high'),
 244    'nationnotes'=>array('nn_configure'),
 245    'patientportal'=>array('portal'),
 246    'menus'=>array('modle')
 247   ),
 248   NULL, array($admin), NULL, NULL,
 249   1, 1, 'write', 'Administrators can do anything'
 250  );
 251      // xl('Administrators can do anything')
 252
 253  // Set permissions for physicians.
 254  //
 255  $gacl->add_acl(
 256   array(
 257    'placeholder'=>array('filler')
 258   ),
 259   NULL, array($doc), NULL, NULL,
 260   1, 1, 'view', 'Things that physicians can only read'
 261  );
 262      // xl('Things that physicians can only read')
 263  $gacl->add_acl(
 264   array(
 265    'placeholder'=>array('filler')
 266   ),
 267   NULL, array($doc), NULL, NULL,
 268   1, 1, 'addonly', 'Things that physicians can read and enter but not modify'
 269  );
 270      // xl('Things that physicians can read and enter but not modify')
 271  $gacl->add_acl(
 272   array(
 273    'placeholder'=>array('filler')
 274   ),
 275   NULL, array($doc), NULL, NULL,
 276   1, 1, 'wsome', 'Things that physicians can read and partly modify'
 277  );
 278      // xl('Things that physicians can read and partly modify')
 279
 280  $gacl->add_acl(
 281   array(
 282    'acct'=>array('disc', 'rep'),
 283    'admin'=>array('drugs'),
 284    'encounters'=>array('auth_a', 'coding_a', 'notes_a', 'date_a'),
 285    'patients' => array('appt', 'demo', 'med', 'trans', 'docs', 'notes', 'sign', 'reminder', 'alert',
 286      'disclosure', 'rx', 'amendment', 'lab'),
 287    'sensitivities'=>array('normal', 'high')
 288   ),
 289   NULL, array($doc), NULL, NULL,
 290   1, 1, 'write', 'Things that physicians can read and modify'
 291  );
 292      // xl('Things that physicians can read and modify')
 293
 294  // Set permissions for clinicians.
 295  //
 296  $gacl->add_acl(
 297   array(
 298    'placeholder'=>array('filler')
 299   ),
 300   NULL, array($clin), NULL, NULL,
 301   1, 1, 'view', 'Things that clinicians can only read'
 302  );
 303      // xl('Things that clinicians can only read')
 304  $gacl->add_acl(
 305   array(
 306    'encounters'=>array('notes', 'relaxed'),
 307    'patients'=>array('demo', 'med', 'docs', 'notes'),
 308    'sensitivities'=>array('normal')
 309   ),
 310   NULL, array($clin), NULL, NULL,
 311   1, 1, 'addonly', 'Things that clinicians can read and enter but not modify'
 312  );
 313      // xl('Things that clinicians can read and enter but not modify')
 314
 315  $gacl->add_acl(
 316   array(
 317    'placeholder'=>array('filler')
 318   ),
 319   NULL, array($clin), NULL, NULL,
 320   1, 1, 'wsome', 'Things that clinicians can read and partly modify'
 321  );
 322      // xl('Things that clinicians can read and partly modify')
 323  $gacl->add_acl(
 324   array(
 325    'admin'=>array('drugs'),
 326    'encounters'=>array('coding'),
 327    'patients'=>array('appt')
 328   ),
 329   NULL, array($clin), NULL, NULL,
 330   1, 1, 'write', 'Things that clinicians can read and modify'
 331  );
 332      // xl('Things that clinicians can read and modify')
 333
 334  // Set permissions for front office staff.
 335  //
 336  $gacl->add_acl(
 337   array(
 338    'placeholder'=>array('filler')
 339   ),
 340   NULL, array($front), NULL, NULL,
 341   1, 1, 'view', 'Things that front office can only read'
 342  );
 343      // xl('Things that front office can only read')
 344  $gacl->add_acl(
 345   array(
 346    'placeholder'=>array('filler')
 347   ),
 348   NULL, array($front), NULL, NULL,
 349   1, 1, 'addonly', 'Things that front office can read and enter but not modify'
 350  );
 351      // xl('Things that front office can read and enter but not modify')
 352  $gacl->add_acl(
 353   array(
 354    'placeholder'=>array('filler')
 355   ),
 356   NULL, array($front), NULL, NULL,
 357   1, 1, 'wsome', 'Things that front office can read and partly modify'
 358  );
 359      // xl('Things that front office can read and partly modify')
 360  $gacl->add_acl(
 361   array(
 362    'patients'=>array('appt', 'demo', 'trans', 'notes')
 363   ),
 364   NULL, array($front), NULL, NULL,
 365   1, 1, 'write', 'Things that front office can read and modify'
 366  );
 367      // xl('Things that front office can read and modify')
 368
 369  // Set permissions for back office staff.
 370  //
 371  $gacl->add_acl(
 372   array(
 373    'placeholder'=>array('filler')
 374   ),
 375   NULL, array($back), NULL, NULL,
 376   1, 1, 'view', 'Things that back office can only read'
 377  );
 378      // xl('Things that back office can only read')
 379  $gacl->add_acl(
 380   array(
 381    'placeholder'=>array('filler')
 382   ),
 383   NULL, array($back), NULL, NULL,
 384   1, 1, 'addonly', 'Things that back office can read and enter but not modify'
 385  );
 386      // xl('Things that back office can read and enter but not modify')
 387  $gacl->add_acl(
 388   array(
 389    'placeholder'=>array('filler')
 390   ),
 391   NULL, array($back), NULL, NULL,
 392   1, 1, 'wsome', 'Things that back office can read and partly modify'
 393  );
 394      // xl('Things that back office can read and partly modify')
 395  $gacl->add_acl(
 396   array(
 397    'acct'=>array('bill', 'disc', 'eob', 'rep', 'rep_a'),
 398    'admin'=>array('practice', 'superbill'),
 399    'encounters'=>array('auth_a', 'coding_a', 'date_a'),
 400    'patients'=>array('appt', 'demo')
 401   ),
 402   NULL, array($back), NULL, NULL,
 403   1, 1, 'write', 'Things that back office can read and modify'
 404  );
 405      // xl('Things that back office can read and modify')
 406
 407  // Set permissions for Emergency Login.
 408  //
 409  $gacl->add_acl(
 410   array(
 411    'acct'=>array('bill', 'disc', 'eob', 'rep', 'rep_a'),
 412    'admin'=>array('calendar', 'database', 'forms', 'practice', 'superbill', 'users', 'batchcom', 'language', 'super', 'drugs', 'acl'),
 413    'encounters'=>array('auth_a', 'coding_a', 'notes_a', 'date_a'),
 414    'lists'=>array('default','state','country','language','ethrace'),
 415    'patients'=>array('appt', 'demo', 'med', 'trans', 'docs', 'notes'),
 416    'sensitivities'=>array('normal', 'high'),
 417    'nationnotes'=>array('nn_configure'),
 418    'patientportal'=>array('portal'),
 419    'menus'=>array('modle')
 420   ),
 421   NULL, array($breakglass), NULL, NULL,
 422   1, 1, 'write', 'Emergency Login user can do anything'
 423  );
 424      // xl('Emergency Login user can do anything')
 425
 426 ?>
 427 <html>
 428 <head>
 429 <title>OpenEMR ACL Setup</title>
 430 <link rel=STYLESHEET href="interface/themes/style_blue.css">
 431 </head>
 432 <body>
 433 <b>OpenEMR ACL Setup</b>
 434 <br>
 435 All done configuring and installing access controls (php-GACL)!
 436 </body>
 437 </html>