acl_setup.php

   1 <?php
   2 /**
   3  * This program is run by the OpenEMR setup.php script to install phpGACL
   4  * and creates the Access Control Objects and their sections.
   5  * See openemr/library/acl.inc file for the list of
   6  * currently supported Access Control Objects(ACO), which this
   7  * script will install.  This script also creates several
   8  * ARO groups, an "admin" ARO, and some reasonable ACL entries for
   9  * the groups.
  10  *   ARO groups include:
  11  *      Administrators
  12  *      Physicians     (Doctors)
  13  *      Clinicians     (Nurses, Physician Assistants, etc.)
  14  *      Front Office   (Receptionist)
  15  *      Accounting
  16  *
  17  * Upgrade Howto
  18  * When upgrading to a new version of OpenEMR, run the acl_upgrade.php
  19  * script to update the phpGACL access controls.  This is required to
  20  * ensure the database includes all the required Access Control
  21  * Objects(ACO).
  22  *
  23  * @package   OpenEMR
  24  * @link      http://www.open-emr.org
  25  * @author    Rod Roark <rod@sunsetsystems.com>
  26  * @author    Brady Miller <brady.g.miller@gmail.com>
  27  * @copyright Copyright (c) 2005-2017 Rod Roark <rod@sunsetsystems.com>
  28  * @copyright Copyright (c) 2017 Brady Miller <brady.g.miller@gmail.com>
  29  * @license   https://github.com/openemr/openemr/blob/master/LICENSE GNU General Public License 3
  30  */
  31
  32 require_once(dirname(__FILE__).'/library/acl.inc');
  33
  34 if (empty($phpgacl_location)) {
  35     die("You must first set up library/acl.inc to use phpGACL!");
  36 }
  37
  38 require_once("$phpgacl_location/gacl_api.class.php");
  39
  40 $gacl = new gacl_api();
  41
  42 // Create the ACO sections.  Every ACO must have a section.
  43 //
  44 if ($gacl->add_object_section('Accounting', 'acct', 10, 0, 'ACO') === false) {
  45     echo "Unable to create the access controls for OpenEMR.  You have likely already run this script (acl_setup.php) successfully.<br>Other possible problems include php-GACL configuration file errors (gacl.ini.php or gacl.class.php).<br>";
  46     return;
  47 }
  48 // xl('Accounting')
  49 $gacl->add_object_section('Administration', 'admin', 10, 0, 'ACO');
  50 // xl('Administration')
  51 $gacl->add_object_section('Encounters', 'encounters', 10, 0, 'ACO');
  52 // xl('Encounters')
  53 $gacl->add_object_section('Lists', 'lists', 10, 0, 'ACO');
  54 // xl('Lists')
  55 $gacl->add_object_section('Patients', 'patients', 10, 0, 'ACO');
  56 // xl('Patients')
  57 $gacl->add_object_section('Squads', 'squads', 10, 0, 'ACO');
  58 // xl('Squads')
  59 $gacl->add_object_section('Sensitivities', 'sensitivities', 10, 0, 'ACO');
  60 // xl('Sensitivities')
  61 $gacl->add_object_section('Placeholder', 'placeholder', 10, 0, 'ACO');
  62 // xl('Placeholder')
  63 $gacl->add_object_section('Nation Notes', 'nationnotes', 10, 0, 'ACO');
  64 // xl('Nation Notes')
  65 $gacl->add_object_section('Patient Portal', 'patientportal', 10, 0, 'ACO');
  66 // xl('Patient Portal')
  67 $gacl->add_object_section('Menus', 'menus', 10, 0, 'ACO');
  68 // xl('Menus')
  69 $gacl->add_object_section('Groups', 'groups', 10, 0, 'ACO');
  70 // xl('Groups')
  71
  72
  73
  74 // Create Accounting ACOs.
  75 //
  76 $gacl->add_object('acct', 'Billing (write optional)', 'bill', 10, 0, 'ACO');
  77 // xl('Billing (write optional)')
  78 $gacl->add_object('acct', 'Price Discounting', 'disc', 10, 0, 'ACO');
  79 // xl('Price Discounting')
  80 $gacl->add_object('acct', 'EOB Data Entry', 'eob', 10, 0, 'ACO');
  81 // xl('EOB Data Entry')
  82 $gacl->add_object('acct', 'Financial Reporting - my encounters', 'rep', 10, 0, 'ACO');
  83 // xl('Financial Reporting - my encounters')
  84 $gacl->add_object('acct', 'Financial Reporting - anything', 'rep_a', 10, 0, 'ACO');
  85 // xl('Financial Reporting - anything')
  86
  87 // Create Administration ACOs.
  88 //
  89 $gacl->add_object('admin', 'Superuser', 'super', 10, 0, 'ACO');
  90 // xl('Superuser')
  91 $gacl->add_object('admin', 'Calendar Settings', 'calendar', 10, 0, 'ACO');
  92 // xl('Calendar Settings')
  93 $gacl->add_object('admin', 'Database Reporting', 'database', 10, 0, 'ACO');
  94 // xl('Database Reporting')
  95 $gacl->add_object('admin', 'Forms Administration', 'forms', 10, 0, 'ACO');
  96 // xl('Forms Administration')
  97 $gacl->add_object('admin', 'Practice Settings', 'practice', 10, 0, 'ACO');
  98 // xl('Practice Settings')
  99 $gacl->add_object('admin', 'Superbill Codes Administration', 'superbill', 10, 0, 'ACO');
 100 // xl('Superbill Codes Administration')
 101 $gacl->add_object('admin', 'Users/Groups/Logs Administration', 'users', 10, 0, 'ACO');
 102 // xl('Users/Groups/Logs Administration')
 103 $gacl->add_object('admin', 'Batch Communication Tool', 'batchcom', 10, 0, 'ACO');
 104 // xl('Batch Communication Tool')
 105 $gacl->add_object('admin', 'Language Interface Tool', 'language', 10, 0, 'ACO');
 106 // xl('Language Interface Tool')
 107 $gacl->add_object('admin', 'Pharmacy Dispensary', 'drugs', 10, 0, 'ACO');
 108 // xl('Pharmacy Dispensary')
 109 $gacl->add_object('admin', 'ACL Administration', 'acl', 10, 0, 'ACO');
 110 // xl('ACL Administration')
 111 $gacl->add_object('admin', 'Multipledb', 'multipledb', 10, 0, 'ACO');
 112 // xl('Multipledb')
 113 $gacl->add_object('admin', 'Menu', 'menu', 10, 0, 'ACO');
 114 // xl('Menu')
 115
 116 // Create ACOs for encounters.
 117 //
 118 $gacl->add_object('encounters', 'Authorize - my encounters', 'auth', 10, 0, 'ACO');
 119 // xl('Authorize - my encounters')
 120 $gacl->add_object('encounters', 'Authorize - any encounters', 'auth_a', 10, 0, 'ACO');
 121 // xl('Authorize - any encounters')
 122 $gacl->add_object('encounters', 'Coding - my encounters (write,wsome optional)', 'coding', 10, 0, 'ACO');
 123 // xl('Coding - my encounters (write,wsome optional)')
 124 $gacl->add_object('encounters', 'Coding - any encounters (write,wsome optional)', 'coding_a', 10, 0, 'ACO');
 125 // xl('Coding - any encounters (write,wsome optional)')
 126 $gacl->add_object('encounters', 'Notes - my encounters (write,addonly optional)', 'notes', 10, 0, 'ACO');
 127 // xl('Notes - my encounters (write,addonly optional)')
 128 $gacl->add_object('encounters', 'Notes - any encounters (write,addonly optional)', 'notes_a', 10, 0, 'ACO');
 129 // xl('Notes - any encounters (write,addonly optional)')
 130 $gacl->add_object('encounters', 'Fix encounter dates - any encounters', 'date_a', 10, 0, 'ACO');
 131 // xl('Fix encounter dates - any encounters')
 132 $gacl->add_object('encounters', 'Less-private information (write,addonly optional)', 'relaxed', 10, 0, 'ACO');
 133 // xl('Less-private information (write,addonly optional)')
 134
 135 // Create ACOs for lists.
 136 //
 137 $gacl->add_object('lists', 'Default List (write,addonly optional)', 'default', 10, 0, 'ACO');
 138 // xl('Default List (write,addonly optional)')
 139 $gacl->add_object('lists', 'State List (write,addonly optional)', 'state', 10, 0, 'ACO');
 140 // xl('State List (write,addonly optional)')
 141 $gacl->add_object('lists', 'Country List (write,addonly optional)', 'country', 10, 0, 'ACO');
 142 // xl('Country List (write,addonly optional)')
 143 $gacl->add_object('lists', 'Language List (write,addonly optional)', 'language', 10, 0, 'ACO');
 144 // xl('Language List (write,addonly optional)')
 145 $gacl->add_object('lists', 'Ethnicity-Race List (write,addonly optional)', 'ethrace', 10, 0, 'ACO');
 146 // xl('Ethnicity-Race List (write,addonly optional)')
 147
 148 // Create ACOs for patientportal.
 149 //
 150 $gacl->add_object('patientportal', 'Patient Portal', 'portal', 10, 0, 'ACO');
 151 // xl('Patient Portal')
 152
 153 // Create ACOs for modules.
 154 //
 155 $gacl->add_object('menus', 'Modules', 'modle', 10, 0, 'ACO');
 156 // xl('Modules')
 157
 158 // Create ACOs for patients.
 159 //
 160 $gacl->add_object('patients', 'Appointments (write,wsome optional)', 'appt', 10, 0, 'ACO');
 161 // xl('Appointments (write,wsome optional)')
 162 $gacl->add_object('patients', 'Demographics (write,addonly optional)', 'demo', 10, 0, 'ACO');
 163 // xl('Demographics (write,addonly optional)')
 164 $gacl->add_object('patients', 'Medical/History (write,addonly optional)', 'med', 10, 0, 'ACO');
 165 // xl('Medical/History (write,addonly optional)')
 166 $gacl->add_object('patients', 'Transactions (write optional)', 'trans', 10, 0, 'ACO');
 167 // xl('Transactions (write optional)')
 168 $gacl->add_object('patients', 'Documents (write,addonly optional)', 'docs', 10, 0, 'ACO');
 169 // xl('Documents (write,addonly optional)')
 170 $gacl->add_object('patients', 'Patient Notes (write,addonly optional)', 'notes', 10, 0, 'ACO');
 171 // xl('Patient Notes (write,addonly optional)')
 172 $gacl->add_object('patients', 'Sign Lab Results (write,addonly optional)', 'sign', 10, 0, 'ACO');
 173 // xl('Sign Lab Results (write,addonly optional)')
 174 $gacl->add_object('patients', 'Patient Reminders (write,addonly optional)', 'reminder', 10, 0, 'ACO');
 175 // xl('Patient Reminders (write,addonly optional)')
 176 $gacl->add_object('patients', 'Clinical Reminders/Alerts (write,addonly optional)', 'alert', 10, 0, 'ACO');
 177 // xl('Clinical Reminders/Alerts (write,addonly optional)')
 178 $gacl->add_object('patients', 'Disclosures (write,addonly optional)', 'disclosure', 10, 0, 'ACO');
 179 // xl('Disclosures (write,addonly optional)')
 180 $gacl->add_object('patients', 'Prescriptions (write,addonly optional)', 'rx', 10, 0, 'ACO');
 181 // xl('Prescriptions (write,addonly optional)')
 182 $gacl->add_object('patients', 'Amendments (write,addonly optional)', 'amendment', 10, 0, 'ACO');
 183 // xl('Amendments (write,addonly optional)')
 184 $gacl->add_object('patients', 'Lab Results (write,addonly optional)', 'lab', 10, 0, 'ACO');
 185 // xl('Lab Results (write,addonly optional)')
 186
 187
 188 $gacl->add_object('groups', 'View/Add/Update groups', 'gadd', 10, 0, 'ACO');
 189 // xl('View/Add/Update groups')
 190 $gacl->add_object('groups', 'View/Create/Update groups appointment in calendar', 'gcalendar', 10, 0, 'ACO');
 191 // xl('View/Create/Update groups appointment in calendar')
 192 $gacl->add_object('groups', 'Group encounter log', 'glog', 10, 0, 'ACO');
 193 // xl('Group encounter log')
 194 $gacl->add_object('groups', 'Group detailed log of appointment in patient record', 'gdlog', 10, 0, 'ACO');
 195 // xl('Group detailed log of appointment in patient record')
 196 $gacl->add_object('groups', 'Send message from the permanent group therapist to the personal therapist', 'gm', 10, 0, 'ACO');
 197 // xl('Send message from the permanent group therapist to the personal therapist')
 198
 199 // Create ACOs for sensitivities.
 200 //
 201 $gacl->add_object('sensitivities', 'Normal', 'normal', 10, 0, 'ACO');
 202 // xl('Normal')
 203 $gacl->add_object('sensitivities', 'High', 'high', 20, 0, 'ACO');
 204 // xl('High')
 205
 206 // Create ACO for placeholder.
 207 //
 208 $gacl->add_object('placeholder', 'Placeholder (Maintains empty ACLs)', 'filler', 10, 0, 'ACO');
 209 // xl('Placeholder (Maintains empty ACLs)')
 210
 211 // Create ACO for nationnotes.
 212 //
 213 $gacl->add_object('nationnotes', 'Nation Notes Configure', 'nn_configure', 10, 0, 'ACO');
 214 // xl('Nation Notes Configure')
 215
 216 // Create ARO groups.
 217 //
 218 $users = $gacl->add_group('users', 'OpenEMR Users', 0, 'ARO');
 219 // xl('OpenEMR Users')
 220 $admin = $gacl->add_group('admin', 'Administrators', $users, 'ARO');
 221 // xl('Administrators')
 222 $clin  = $gacl->add_group('clin', 'Clinicians', $users, 'ARO');
 223 // xl('Clinicians')
 224 $doc   = $gacl->add_group('doc', 'Physicians', $users, 'ARO');
 225 // xl('Physicians')
 226 $front = $gacl->add_group('front', 'Front Office', $users, 'ARO');
 227 // xl('Front Office')
 228 $back  = $gacl->add_group('back', 'Accounting', $users, 'ARO');
 229 // xl('Accounting')
 230 $breakglass  = $gacl->add_group('breakglass', 'Emergency Login', $users, 'ARO');
 231 // xl('Emergency Login')
 232
 233
 234 // Create a Users section for the AROs (humans).
 235 //
 236 $gacl->add_object_section('Users', 'users', 10, 0, 'ARO');
 237 // xl('Users')
 238
 239 // Create the Administrator in the above-created "users" section
 240 // and add him/her to the above-created "admin" group.
 241 // If this script is being used by OpenEMR's setup, then will
 242 //   incorporate the installation values. Otherwise will
 243 //    hardcode the 'admin' user.
 244 if (isset($this) && isset($this->iuser)) {
 245     $gacl->add_object('users', $this->iuname, $this->iuser, 10, 0, 'ARO');
 246     $gacl->add_group_object($admin, 'users', $this->iuser, 'ARO');
 247 } else {
 248     $gacl->add_object('users', 'Administrator', 'admin', 10, 0, 'ARO');
 249     $gacl->add_group_object($admin, 'users', 'admin', 'ARO');
 250 }
 251
 252 // Declare return terms for language translations
 253 //  xl('write') xl('wsome') xl('addonly') xl('view')
 254
 255 // Set permissions for administrators.
 256 //
 257 $gacl->add_acl(
 258     array(
 259         'acct'=>array('bill', 'disc', 'eob', 'rep', 'rep_a'),
 260         'admin'=>array('calendar', 'database', 'forms', 'practice', 'superbill', 'users', 'batchcom', 'language', 'super', 'drugs', 'acl','multipledb','menu'),
 261         'encounters'=>array('auth_a', 'auth', 'coding_a', 'coding', 'notes_a', 'notes', 'date_a', 'relaxed'),
 262         'lists'=>array('default','state','country','language','ethrace'),
 263         'patients'=>array('appt', 'demo', 'med', 'trans', 'docs', 'notes', 'sign', 'reminder', 'alert', 'disclosure', 'rx', 'amendment', 'lab'),
 264         'sensitivities'=>array('normal', 'high'),
 265         'nationnotes'=>array('nn_configure'),
 266         'patientportal'=>array('portal'),
 267         'menus'=>array('modle'),
 268         'groups'=>array('gadd','gcalendar','glog','gdlog','gm')
 269     ),
 270     null,
 271     array($admin),
 272     null,
 273     null,
 274     1,
 275     1,
 276     'write',
 277     'Administrators can do anything'
 278 );
 279 // xl('Administrators can do anything')
 280
 281 // Set permissions for physicians.
 282 //
 283 $gacl->add_acl(
 284     array(
 285         'placeholder'=>array('filler')
 286     ),
 287     null,
 288     array($doc),
 289     null,
 290     null,
 291     1,
 292     1,
 293     'view',
 294     'Things that physicians can only read'
 295 );
 296 // xl('Things that physicians can only read')
 297 $gacl->add_acl(
 298     array(
 299         'placeholder'=>array('filler')
 300     ),
 301     null,
 302     array($doc),
 303     null,
 304     null,
 305     1,
 306     1,
 307     'addonly',
 308     'Things that physicians can read and enter but not modify'
 309 );
 310 // xl('Things that physicians can read and enter but not modify')
 311 $gacl->add_acl(
 312     array(
 313         'placeholder'=>array('filler')
 314     ),
 315     null,
 316     array($doc),
 317     null,
 318     null,
 319     1,
 320     1,
 321     'wsome',
 322     'Things that physicians can read and partly modify'
 323 );
 324 // xl('Things that physicians can read and partly modify')
 325 $gacl->add_acl(
 326     array(
 327         'acct'=>array('disc', 'rep'),
 328         'admin'=>array('drugs'),
 329         'encounters'=>array('auth_a', 'auth', 'coding_a', 'coding', 'notes_a', 'notes', 'date_a', 'relaxed'),
 330         'patients' => array('appt', 'demo', 'med', 'trans', 'docs', 'notes', 'sign', 'reminder', 'alert',
 331         'disclosure', 'rx', 'amendment', 'lab'),
 332         'sensitivities'=>array('normal', 'high'),
 333         'groups'=>array('gcalendar','glog')
 334     ),
 335     null,
 336     array($doc),
 337     null,
 338     null,
 339     1,
 340     1,
 341     'write',
 342     'Things that physicians can read and modify'
 343 );
 344 // xl('Things that physicians can read and modify')
 345
 346 // Set permissions for clinicians.
 347 //
 348 $gacl->add_acl(
 349     array(
 350         'placeholder'=>array('filler')
 351     ),
 352     null,
 353     array($clin),
 354     null,
 355     null,
 356     1,
 357     1,
 358     'view',
 359     'Things that clinicians can only read'
 360 );
 361 // xl('Things that clinicians can only read')
 362 $gacl->add_acl(
 363     array(
 364         'encounters'=>array('notes', 'relaxed'),
 365         'patients'=>array('demo', 'med', 'docs', 'notes','trans', 'reminder', 'alert', 'disclosure', 'rx', 'amendment', 'lab'),
 366         'sensitivities'=>array('normal')
 367     ),
 368     null,
 369     array($clin),
 370     null,
 371     null,
 372     1,
 373     1,
 374     'addonly',
 375     'Things that clinicians can read and enter but not modify'
 376 );
 377 // xl('Things that clinicians can read and enter but not modify')
 378 $gacl->add_acl(
 379     array(
 380         'placeholder'=>array('filler')
 381     ),
 382     null,
 383     array($clin),
 384     null,
 385     null,
 386     1,
 387     1,
 388     'wsome',
 389     'Things that clinicians can read and partly modify'
 390 );
 391 // xl('Things that clinicians can read and partly modify')
 392 $gacl->add_acl(
 393     array(
 394         'admin'=>array('drugs'),
 395         'encounters'=>array('coding'),
 396         'patients'=>array('appt'),
 397         'groups'=>array('gcalendar','glog')
 398     ),
 399     null,
 400     array($clin),
 401     null,
 402     null,
 403     1,
 404     1,
 405     'write',
 406     'Things that clinicians can read and modify'
 407 );
 408 // xl('Things that clinicians can read and modify')
 409
 410 // Set permissions for front office staff.
 411 //
 412 $gacl->add_acl(
 413     array(
 414         'patients'=>array('alert')
 415     ),
 416     null,
 417     array($front),
 418     null,
 419     null,
 420     1,
 421     1,
 422     'view',
 423     'Things that front office can only read'
 424 );
 425 // xl('Things that front office can only read')
 426 $gacl->add_acl(
 427     array(
 428         'placeholder'=>array('filler')
 429     ),
 430     null,
 431     array($front),
 432     null,
 433     null,
 434     1,
 435     1,
 436     'addonly',
 437     'Things that front office can read and enter but not modify'
 438 );
 439 // xl('Things that front office can read and enter but not modify')
 440 $gacl->add_acl(
 441     array(
 442         'placeholder'=>array('filler')
 443     ),
 444     null,
 445     array($front),
 446     null,
 447     null,
 448     1,
 449     1,
 450     'wsome',
 451     'Things that front office can read and partly modify'
 452 );
 453 // xl('Things that front office can read and partly modify')
 454 $gacl->add_acl(
 455     array(
 456         'patients'=>array('appt', 'demo', 'trans', 'notes'),
 457         'groups'=>array('gcalendar')
 458     ),
 459     null,
 460     array($front),
 461     null,
 462     null,
 463     1,
 464     1,
 465     'write',
 466     'Things that front office can read and modify'
 467 );
 468 // xl('Things that front office can read and modify')
 469
 470 // Set permissions for back office staff.
 471 //
 472 $gacl->add_acl(
 473     array(
 474         'patients'=>array('alert')
 475     ),
 476     null,
 477     array($back),
 478     null,
 479     null,
 480     1,
 481     1,
 482     'view',
 483     'Things that back office can only read'
 484 );
 485 // xl('Things that back office can only read')
 486 $gacl->add_acl(
 487     array(
 488         'placeholder'=>array('filler')
 489     ),
 490     null,
 491     array($back),
 492     null,
 493     null,
 494     1,
 495     1,
 496     'addonly',
 497     'Things that back office can read and enter but not modify'
 498 );
 499 // xl('Things that back office can read and enter but not modify')
 500 $gacl->add_acl(
 501     array(
 502         'placeholder'=>array('filler')
 503     ),
 504     null,
 505     array($back),
 506     null,
 507     null,
 508     1,
 509     1,
 510     'wsome',
 511     'Things that back office can read and partly modify'
 512 );
 513 // xl('Things that back office can read and partly modify')
 514 $gacl->add_acl(
 515     array(
 516         'acct'=>array('bill', 'disc', 'eob', 'rep', 'rep_a'),
 517         'admin'=>array('practice', 'superbill'),
 518         'encounters'=>array('auth_a', 'coding_a', 'date_a'),
 519         'patients'=>array('appt', 'demo')
 520     ),
 521     null,
 522     array($back),
 523     null,
 524     null,
 525     1,
 526     1,
 527     'write',
 528     'Things that back office can read and modify'
 529 );
 530 // xl('Things that back office can read and modify')
 531
 532 // Set permissions for Emergency Login.
 533 //
 534 $gacl->add_acl(
 535     array(
 536         'acct'=>array('bill', 'disc', 'eob', 'rep', 'rep_a'),
 537         'admin'=>array('calendar', 'database', 'forms', 'practice', 'superbill', 'users', 'batchcom', 'language', 'super', 'drugs', 'acl','multipledb','menu'),
 538         'encounters'=>array('auth_a', 'auth', 'coding_a', 'coding', 'notes_a', 'notes', 'date_a', 'relaxed'),
 539         'lists'=>array('default','state','country','language','ethrace'),
 540         'patients'=>array('appt', 'demo', 'med', 'trans', 'docs', 'notes', 'sign', 'reminder', 'alert', 'disclosure', 'rx', 'amendment', 'lab'),
 541         'sensitivities'=>array('normal', 'high'),
 542         'nationnotes'=>array('nn_configure'),
 543         'patientportal'=>array('portal'),
 544         'menus'=>array('modle'),
 545         'groups'=>array('gadd','gcalendar','glog','gdlog','gm')
 546     ),
 547     null,
 548     array($breakglass),
 549     null,
 550     null,
 551     1,
 552     1,
 553     'write',
 554     'Emergency Login user can do anything'
 555 );
 556 // xl('Emergency Login user can do anything')
 557
 558 ?>
 559 <html>
 560 <head>
 561 <title>OpenEMR ACL Setup</title>
 562 <link rel=STYLESHEET href="interface/themes/style_blue.css">
 563 </head>
 564 <body>
 565 <b>OpenEMR ACL Setup</b>
 566 <br>
 567 All done configuring and installing access controls (php-GACL)!
 568 </body>
 569 </html>