- travis
[openemr.git] / acl_setup.php
blob662958bcc2ae78d684c07f4aebe8c2b01d485380
1 <?php
2 /**
3 * This program is run by the OpenEMR setup.php script to install phpGACL
4 * and creates the Access Control Objects and their sections.
5 * See openemr/library/acl.inc file for the list of
6 * currently supported Access Control Objects(ACO), which this
7 * script will install. This script also creates several
8 * ARO groups, an "admin" ARO, and some reasonable ACL entries for
9 * the groups.
10 * ARO groups include:
11 * Administrators
12 * Physicians (Doctors)
13 * Clinicians (Nurses, Physician Assistants, etc.)
14 * Front Office (Receptionist)
15 * Accounting
17 * Upgrade Howto
18 * When upgrading to a new version of OpenEMR, run the acl_upgrade.php
19 * script to update the phpGACL access controls. This is required to
20 * ensure the database includes all the required Access Control
21 * Objects(ACO).
23 * @package OpenEMR
24 * @link http://www.open-emr.org
25 * @author Rod Roark <rod@sunsetsystems.com>
26 * @author Brady Miller <brady.g.miller@gmail.com>
27 * @copyright Copyright (c) 2005-2017 Rod Roark <rod@sunsetsystems.com>
28 * @copyright Copyright (c) 2017 Brady Miller <brady.g.miller@gmail.com>
29 * @license https://github.com/openemr/openemr/blob/master/LICENSE GNU General Public License 3
32 require_once(dirname(__FILE__).'/library/acl.inc');
34 if (empty($phpgacl_location)) {
35 die("You must first set up library/acl.inc to use phpGACL!");
38 require_once("$phpgacl_location/gacl_api.class.php");
40 $gacl = new gacl_api();
42 // Create the ACO sections. Every ACO must have a section.
44 if ($gacl->add_object_section('Accounting', 'acct', 10, 0, 'ACO') === false) {
45 echo "Unable to create the access controls for OpenEMR. You have likely already run this script (acl_setup.php) successfully.<br>Other possible problems include php-GACL configuration file errors (gacl.ini.php or gacl.class.php).<br>";
46 return;
48 // xl('Accounting')
49 $gacl->add_object_section('Administration', 'admin', 10, 0, 'ACO');
50 // xl('Administration')
51 $gacl->add_object_section('Encounters', 'encounters', 10, 0, 'ACO');
52 // xl('Encounters')
53 $gacl->add_object_section('Lists', 'lists', 10, 0, 'ACO');
54 // xl('Lists')
55 $gacl->add_object_section('Patients', 'patients', 10, 0, 'ACO');
56 // xl('Patients')
57 $gacl->add_object_section('Squads', 'squads', 10, 0, 'ACO');
58 // xl('Squads')
59 $gacl->add_object_section('Sensitivities', 'sensitivities', 10, 0, 'ACO');
60 // xl('Sensitivities')
61 $gacl->add_object_section('Placeholder', 'placeholder', 10, 0, 'ACO');
62 // xl('Placeholder')
63 $gacl->add_object_section('Nation Notes', 'nationnotes', 10, 0, 'ACO');
64 // xl('Nation Notes')
65 $gacl->add_object_section('Patient Portal', 'patientportal', 10, 0, 'ACO');
66 // xl('Patient Portal')
67 $gacl->add_object_section('Menus', 'menus', 10, 0, 'ACO');
68 // xl('Menus')
69 $gacl->add_object_section('Groups', 'groups', 10, 0, 'ACO');
70 // xl('Groups')
74 // Create Accounting ACOs.
76 $gacl->add_object('acct', 'Billing (write optional)', 'bill', 10, 0, 'ACO');
77 // xl('Billing (write optional)')
78 $gacl->add_object('acct', 'Price Discounting', 'disc', 10, 0, 'ACO');
79 // xl('Price Discounting')
80 $gacl->add_object('acct', 'EOB Data Entry', 'eob', 10, 0, 'ACO');
81 // xl('EOB Data Entry')
82 $gacl->add_object('acct', 'Financial Reporting - my encounters', 'rep', 10, 0, 'ACO');
83 // xl('Financial Reporting - my encounters')
84 $gacl->add_object('acct', 'Financial Reporting - anything', 'rep_a', 10, 0, 'ACO');
85 // xl('Financial Reporting - anything')
87 // Create Administration ACOs.
89 $gacl->add_object('admin', 'Superuser', 'super', 10, 0, 'ACO');
90 // xl('Superuser')
91 $gacl->add_object('admin', 'Calendar Settings', 'calendar', 10, 0, 'ACO');
92 // xl('Calendar Settings')
93 $gacl->add_object('admin', 'Database Reporting', 'database', 10, 0, 'ACO');
94 // xl('Database Reporting')
95 $gacl->add_object('admin', 'Forms Administration', 'forms', 10, 0, 'ACO');
96 // xl('Forms Administration')
97 $gacl->add_object('admin', 'Practice Settings', 'practice', 10, 0, 'ACO');
98 // xl('Practice Settings')
99 $gacl->add_object('admin', 'Superbill Codes Administration', 'superbill', 10, 0, 'ACO');
100 // xl('Superbill Codes Administration')
101 $gacl->add_object('admin', 'Users/Groups/Logs Administration', 'users', 10, 0, 'ACO');
102 // xl('Users/Groups/Logs Administration')
103 $gacl->add_object('admin', 'Batch Communication Tool', 'batchcom', 10, 0, 'ACO');
104 // xl('Batch Communication Tool')
105 $gacl->add_object('admin', 'Language Interface Tool', 'language', 10, 0, 'ACO');
106 // xl('Language Interface Tool')
107 $gacl->add_object('admin', 'Pharmacy Dispensary', 'drugs', 10, 0, 'ACO');
108 // xl('Pharmacy Dispensary')
109 $gacl->add_object('admin', 'ACL Administration', 'acl', 10, 0, 'ACO');
110 // xl('ACL Administration')
111 $gacl->add_object('admin', 'Multipledb', 'multipledb', 10, 0, 'ACO');
112 // xl('Multipledb')
113 $gacl->add_object('admin', 'Menu', 'menu', 10, 0, 'ACO');
114 // xl('Menu')
115 $gacl->add_object('admin', 'Manage modules', 'manage_modules', 10, 0, 'ACO');
116 // xl('Manage modules')
119 // Create ACOs for encounters.
121 $gacl->add_object('encounters', 'Authorize - my encounters', 'auth', 10, 0, 'ACO');
122 // xl('Authorize - my encounters')
123 $gacl->add_object('encounters', 'Authorize - any encounters', 'auth_a', 10, 0, 'ACO');
124 // xl('Authorize - any encounters')
125 $gacl->add_object('encounters', 'Coding - my encounters (write,wsome optional)', 'coding', 10, 0, 'ACO');
126 // xl('Coding - my encounters (write,wsome optional)')
127 $gacl->add_object('encounters', 'Coding - any encounters (write,wsome optional)', 'coding_a', 10, 0, 'ACO');
128 // xl('Coding - any encounters (write,wsome optional)')
129 $gacl->add_object('encounters', 'Notes - my encounters (write,addonly optional)', 'notes', 10, 0, 'ACO');
130 // xl('Notes - my encounters (write,addonly optional)')
131 $gacl->add_object('encounters', 'Notes - any encounters (write,addonly optional)', 'notes_a', 10, 0, 'ACO');
132 // xl('Notes - any encounters (write,addonly optional)')
133 $gacl->add_object('encounters', 'Fix encounter dates - any encounters', 'date_a', 10, 0, 'ACO');
134 // xl('Fix encounter dates - any encounters')
135 $gacl->add_object('encounters', 'Less-private information (write,addonly optional)', 'relaxed', 10, 0, 'ACO');
136 // xl('Less-private information (write,addonly optional)')
138 // Create ACOs for lists.
140 $gacl->add_object('lists', 'Default List (write,addonly optional)', 'default', 10, 0, 'ACO');
141 // xl('Default List (write,addonly optional)')
142 $gacl->add_object('lists', 'State List (write,addonly optional)', 'state', 10, 0, 'ACO');
143 // xl('State List (write,addonly optional)')
144 $gacl->add_object('lists', 'Country List (write,addonly optional)', 'country', 10, 0, 'ACO');
145 // xl('Country List (write,addonly optional)')
146 $gacl->add_object('lists', 'Language List (write,addonly optional)', 'language', 10, 0, 'ACO');
147 // xl('Language List (write,addonly optional)')
148 $gacl->add_object('lists', 'Ethnicity-Race List (write,addonly optional)', 'ethrace', 10, 0, 'ACO');
149 // xl('Ethnicity-Race List (write,addonly optional)')
151 // Create ACOs for patientportal.
153 $gacl->add_object('patientportal', 'Patient Portal', 'portal', 10, 0, 'ACO');
154 // xl('Patient Portal')
156 // Create ACOs for modules.
158 $gacl->add_object('menus', 'Modules', 'modle', 10, 0, 'ACO');
159 // xl('Modules')
161 // Create ACOs for patients.
163 $gacl->add_object('patients', 'Appointments (write,wsome optional)', 'appt', 10, 0, 'ACO');
164 // xl('Appointments (write,wsome optional)')
165 $gacl->add_object('patients', 'Demographics (write,addonly optional)', 'demo', 10, 0, 'ACO');
166 // xl('Demographics (write,addonly optional)')
167 $gacl->add_object('patients', 'Medical/History (write,addonly optional)', 'med', 10, 0, 'ACO');
168 // xl('Medical/History (write,addonly optional)')
169 $gacl->add_object('patients', 'Transactions (write optional)', 'trans', 10, 0, 'ACO');
170 // xl('Transactions (write optional)')
171 $gacl->add_object('patients', 'Documents (write,addonly optional)', 'docs', 10, 0, 'ACO');
172 // xl('Documents (write,addonly optional)')
173 $gacl->add_object('patients', 'Documents Delete', 'docs_rm', 10, 0, 'ACO');
174 // xl('Documents Delete')
175 $gacl->add_object('patients', 'Patient Notes (write,addonly optional)', 'notes', 10, 0, 'ACO');
176 // xl('Patient Notes (write,addonly optional)')
177 $gacl->add_object('patients', 'Sign Lab Results (write,addonly optional)', 'sign', 10, 0, 'ACO');
178 // xl('Sign Lab Results (write,addonly optional)')
179 $gacl->add_object('patients', 'Patient Reminders (write,addonly optional)', 'reminder', 10, 0, 'ACO');
180 // xl('Patient Reminders (write,addonly optional)')
181 $gacl->add_object('patients', 'Clinical Reminders/Alerts (write,addonly optional)', 'alert', 10, 0, 'ACO');
182 // xl('Clinical Reminders/Alerts (write,addonly optional)')
183 $gacl->add_object('patients', 'Disclosures (write,addonly optional)', 'disclosure', 10, 0, 'ACO');
184 // xl('Disclosures (write,addonly optional)')
185 $gacl->add_object('patients', 'Prescriptions (write,addonly optional)', 'rx', 10, 0, 'ACO');
186 // xl('Prescriptions (write,addonly optional)')
187 $gacl->add_object('patients', 'Amendments (write,addonly optional)', 'amendment', 10, 0, 'ACO');
188 // xl('Amendments (write,addonly optional)')
189 $gacl->add_object('patients', 'Lab Results (write,addonly optional)', 'lab', 10, 0, 'ACO');
190 // xl('Lab Results (write,addonly optional)')
191 $gacl->add_object('patients', 'Patient Report', 'pat_rep', 10, 0, 'ACO');
192 // xl('Patient Report')
195 $gacl->add_object('groups', 'View/Add/Update groups', 'gadd', 10, 0, 'ACO');
196 // xl('View/Add/Update groups')
197 $gacl->add_object('groups', 'View/Create/Update groups appointment in calendar', 'gcalendar', 10, 0, 'ACO');
198 // xl('View/Create/Update groups appointment in calendar')
199 $gacl->add_object('groups', 'Group encounter log', 'glog', 10, 0, 'ACO');
200 // xl('Group encounter log')
201 $gacl->add_object('groups', 'Group detailed log of appointment in patient record', 'gdlog', 10, 0, 'ACO');
202 // xl('Group detailed log of appointment in patient record')
203 $gacl->add_object('groups', 'Send message from the permanent group therapist to the personal therapist', 'gm', 10, 0, 'ACO');
204 // xl('Send message from the permanent group therapist to the personal therapist')
206 // Create ACOs for sensitivities.
208 $gacl->add_object('sensitivities', 'Normal', 'normal', 10, 0, 'ACO');
209 // xl('Normal')
210 $gacl->add_object('sensitivities', 'High', 'high', 20, 0, 'ACO');
211 // xl('High')
213 // Create ACO for placeholder.
215 $gacl->add_object('placeholder', 'Placeholder (Maintains empty ACLs)', 'filler', 10, 0, 'ACO');
216 // xl('Placeholder (Maintains empty ACLs)')
218 // Create ACO for nationnotes.
220 $gacl->add_object('nationnotes', 'Nation Notes Configure', 'nn_configure', 10, 0, 'ACO');
221 // xl('Nation Notes Configure')
223 // Create ARO groups.
225 $users = $gacl->add_group('users', 'OpenEMR Users', 0, 'ARO');
226 // xl('OpenEMR Users')
227 $admin = $gacl->add_group('admin', 'Administrators', $users, 'ARO');
228 // xl('Administrators')
229 $clin = $gacl->add_group('clin', 'Clinicians', $users, 'ARO');
230 // xl('Clinicians')
231 $doc = $gacl->add_group('doc', 'Physicians', $users, 'ARO');
232 // xl('Physicians')
233 $front = $gacl->add_group('front', 'Front Office', $users, 'ARO');
234 // xl('Front Office')
235 $back = $gacl->add_group('back', 'Accounting', $users, 'ARO');
236 // xl('Accounting')
237 $breakglass = $gacl->add_group('breakglass', 'Emergency Login', $users, 'ARO');
238 // xl('Emergency Login')
241 // Create a Users section for the AROs (humans).
243 $gacl->add_object_section('Users', 'users', 10, 0, 'ARO');
244 // xl('Users')
246 // Create the Administrator in the above-created "users" section
247 // and add him/her to the above-created "admin" group.
248 // If this script is being used by OpenEMR's setup, then will
249 // incorporate the installation values. Otherwise will
250 // hardcode the 'admin' user.
251 if (isset($this) && isset($this->iuser)) {
252 $gacl->add_object('users', $this->iuname, $this->iuser, 10, 0, 'ARO');
253 $gacl->add_group_object($admin, 'users', $this->iuser, 'ARO');
254 } else {
255 $gacl->add_object('users', 'Administrator', 'admin', 10, 0, 'ARO');
256 $gacl->add_group_object($admin, 'users', 'admin', 'ARO');
259 // Declare return terms for language translations
260 // xl('write') xl('wsome') xl('addonly') xl('view')
262 // Set permissions for administrators.
264 $gacl->add_acl(
265 array(
266 'acct'=>array('bill', 'disc', 'eob', 'rep', 'rep_a'),
267 'admin'=>array('calendar', 'database', 'forms', 'practice', 'superbill', 'users', 'batchcom', 'language', 'super', 'drugs', 'acl','multipledb','menu','manage_modules'),
268 'encounters'=>array('auth_a', 'auth', 'coding_a', 'coding', 'notes_a', 'notes', 'date_a', 'relaxed'),
269 'lists'=>array('default','state','country','language','ethrace'),
270 'patients'=>array('appt', 'demo', 'med', 'trans', 'docs', 'notes', 'sign', 'reminder', 'alert', 'disclosure', 'rx', 'amendment', 'lab', 'docs_rm','pat_rep'),
271 'sensitivities'=>array('normal', 'high'),
272 'nationnotes'=>array('nn_configure'),
273 'patientportal'=>array('portal'),
274 'menus'=>array('modle'),
275 'groups'=>array('gadd','gcalendar','glog','gdlog','gm')
277 null,
278 array($admin),
279 null,
280 null,
283 'write',
284 'Administrators can do anything'
286 // xl('Administrators can do anything')
288 // Set permissions for physicians.
290 $gacl->add_acl(
291 array(
292 'patients'=>array('pat_rep')
294 null,
295 array($doc),
296 null,
297 null,
300 'view',
301 'Things that physicians can only read'
303 // xl('Things that physicians can only read')
304 $gacl->add_acl(
305 array(
306 'placeholder'=>array('filler')
308 null,
309 array($doc),
310 null,
311 null,
314 'addonly',
315 'Things that physicians can read and enter but not modify'
317 // xl('Things that physicians can read and enter but not modify')
318 $gacl->add_acl(
319 array(
320 'placeholder'=>array('filler')
322 null,
323 array($doc),
324 null,
325 null,
328 'wsome',
329 'Things that physicians can read and partly modify'
331 // xl('Things that physicians can read and partly modify')
332 $gacl->add_acl(
333 array(
334 'acct'=>array('disc', 'rep'),
335 'admin'=>array('drugs'),
336 'encounters'=>array('auth_a', 'auth', 'coding_a', 'coding', 'notes_a', 'notes', 'date_a', 'relaxed'),
337 'patients' => array('appt', 'demo', 'med', 'trans', 'docs', 'notes', 'sign', 'reminder', 'alert',
338 'disclosure', 'rx', 'amendment', 'lab'),
339 'sensitivities'=>array('normal', 'high'),
340 'groups'=>array('gcalendar','glog')
342 null,
343 array($doc),
344 null,
345 null,
348 'write',
349 'Things that physicians can read and modify'
351 // xl('Things that physicians can read and modify')
353 // Set permissions for clinicians.
355 $gacl->add_acl(
356 array(
357 'patients'=>array('pat_rep')
359 null,
360 array($clin),
361 null,
362 null,
365 'view',
366 'Things that clinicians can only read'
368 // xl('Things that clinicians can only read')
369 $gacl->add_acl(
370 array(
371 'encounters'=>array('notes', 'relaxed'),
372 'patients'=>array('demo', 'med', 'docs', 'notes','trans', 'reminder', 'alert', 'disclosure', 'rx', 'amendment', 'lab'),
373 'sensitivities'=>array('normal')
375 null,
376 array($clin),
377 null,
378 null,
381 'addonly',
382 'Things that clinicians can read and enter but not modify'
384 // xl('Things that clinicians can read and enter but not modify')
385 $gacl->add_acl(
386 array(
387 'placeholder'=>array('filler')
389 null,
390 array($clin),
391 null,
392 null,
395 'wsome',
396 'Things that clinicians can read and partly modify'
398 // xl('Things that clinicians can read and partly modify')
399 $gacl->add_acl(
400 array(
401 'admin'=>array('drugs'),
402 'encounters'=>array('coding'),
403 'patients'=>array('appt'),
404 'groups'=>array('gcalendar','glog')
406 null,
407 array($clin),
408 null,
409 null,
412 'write',
413 'Things that clinicians can read and modify'
415 // xl('Things that clinicians can read and modify')
417 // Set permissions for front office staff.
419 $gacl->add_acl(
420 array(
421 'patients'=>array('alert','pat_rep')
423 null,
424 array($front),
425 null,
426 null,
429 'view',
430 'Things that front office can only read'
432 // xl('Things that front office can only read')
433 $gacl->add_acl(
434 array(
435 'placeholder'=>array('filler')
437 null,
438 array($front),
439 null,
440 null,
443 'addonly',
444 'Things that front office can read and enter but not modify'
446 // xl('Things that front office can read and enter but not modify')
447 $gacl->add_acl(
448 array(
449 'placeholder'=>array('filler')
451 null,
452 array($front),
453 null,
454 null,
457 'wsome',
458 'Things that front office can read and partly modify'
460 // xl('Things that front office can read and partly modify')
461 $gacl->add_acl(
462 array(
463 'patients'=>array('appt', 'demo', 'trans', 'notes'),
464 'groups'=>array('gcalendar')
466 null,
467 array($front),
468 null,
469 null,
472 'write',
473 'Things that front office can read and modify'
475 // xl('Things that front office can read and modify')
477 // Set permissions for back office staff.
479 $gacl->add_acl(
480 array(
481 'patients'=>array('alert','pat_rep')
483 null,
484 array($back),
485 null,
486 null,
489 'view',
490 'Things that back office can only read'
492 // xl('Things that back office can only read')
493 $gacl->add_acl(
494 array(
495 'placeholder'=>array('filler')
497 null,
498 array($back),
499 null,
500 null,
503 'addonly',
504 'Things that back office can read and enter but not modify'
506 // xl('Things that back office can read and enter but not modify')
507 $gacl->add_acl(
508 array(
509 'placeholder'=>array('filler')
511 null,
512 array($back),
513 null,
514 null,
517 'wsome',
518 'Things that back office can read and partly modify'
520 // xl('Things that back office can read and partly modify')
521 $gacl->add_acl(
522 array(
523 'acct'=>array('bill', 'disc', 'eob', 'rep', 'rep_a'),
524 'admin'=>array('practice', 'superbill'),
525 'encounters'=>array('auth_a', 'coding_a', 'date_a'),
526 'patients'=>array('appt', 'demo')
528 null,
529 array($back),
530 null,
531 null,
534 'write',
535 'Things that back office can read and modify'
537 // xl('Things that back office can read and modify')
539 // Set permissions for Emergency Login.
541 $gacl->add_acl(
542 array(
543 'acct'=>array('bill', 'disc', 'eob', 'rep', 'rep_a'),
544 'admin'=>array('calendar', 'database', 'forms', 'practice', 'superbill', 'users', 'batchcom', 'language', 'super', 'drugs', 'acl','multipledb','menu','manage_modules'),
545 'encounters'=>array('auth_a', 'auth', 'coding_a', 'coding', 'notes_a', 'notes', 'date_a', 'relaxed'),
546 'lists'=>array('default','state','country','language','ethrace'),
547 'patients'=>array('appt', 'demo', 'med', 'trans', 'docs', 'notes', 'sign', 'reminder', 'alert', 'disclosure', 'rx', 'amendment', 'lab', 'docs_rm','pat_rep'),
548 'sensitivities'=>array('normal', 'high'),
549 'nationnotes'=>array('nn_configure'),
550 'patientportal'=>array('portal'),
551 'menus'=>array('modle'),
552 'groups'=>array('gadd','gcalendar','glog','gdlog','gm')
554 null,
555 array($breakglass),
556 null,
557 null,
560 'write',
561 'Emergency Login user can do anything'
563 // xl('Emergency Login user can do anything')
566 <html>
567 <head>
568 <title>OpenEMR ACL Setup</title>
569 <link rel=STYLESHEET href="interface/themes/style_blue.css">
570 </head>
571 <body>
572 <b>OpenEMR ACL Setup</b>
573 <br>
574 All done configuring and installing access controls (php-GACL)!
575 </body>
576 </html>