Portal and core fixups. (#3525)
[openemr.git] / acl_setup.php
blob8734f2d8c3c4c1b040bbc0f7df3558199663f362
1 <?php
3 /**
4 * This program is run by the OpenEMR setup.php script to install phpGACL
5 * and creates the Access Control Objects and their sections.
6 * See src/Common/Acl/AclMain.php file for the list of
7 * currently supported Access Control Objects(ACO), which this
8 * script will install. This script also creates several
9 * ARO groups, an "admin" ARO, and some reasonable ACL entries for
10 * the groups.
11 * ARO groups include:
12 * Administrators
13 * Physicians (Doctors)
14 * Clinicians (Nurses, Physician Assistants, etc.)
15 * Front Office (Receptionist)
16 * Accounting
18 * Upgrade Howto
19 * When upgrading to a new version of OpenEMR, run the acl_upgrade.php
20 * script to update the phpGACL access controls. This is required to
21 * ensure the database includes all the required Access Control
22 * Objects(ACO).
24 * @package OpenEMR
25 * @link http://www.open-emr.org
26 * @author Rod Roark <rod@sunsetsystems.com>
27 * @author Brady Miller <brady.g.miller@gmail.com>
28 * @copyright Copyright (c) 2005-2017 Rod Roark <rod@sunsetsystems.com>
29 * @copyright Copyright (c) 2017 Brady Miller <brady.g.miller@gmail.com>
30 * @license https://github.com/openemr/openemr/blob/master/LICENSE GNU General Public License 3
33 use OpenEMR\Gacl\GaclApi;
35 $gacl = new GaclApi();
37 // Create the ACO sections. Every ACO must have a section.
39 if ($gacl->add_object_section('Accounting', 'acct', 10, 0, 'ACO') === false) {
40 echo "Unable to create the access controls for OpenEMR. You have likely already run this script (acl_setup.php) successfully.<br />Other possible problems include php-GACL configuration file errors (gacl.ini.php or Gacl.php).<br>";
41 return;
43 // xl('Accounting')
44 $gacl->add_object_section('Administration', 'admin', 10, 0, 'ACO');
45 // xl('Administration')
46 $gacl->add_object_section('Encounters', 'encounters', 10, 0, 'ACO');
47 // xl('Encounters')
48 $gacl->add_object_section('Lists', 'lists', 10, 0, 'ACO');
49 // xl('Lists')
50 $gacl->add_object_section('Patients', 'patients', 10, 0, 'ACO');
51 // xl('Patients')
52 $gacl->add_object_section('Squads', 'squads', 10, 0, 'ACO');
53 // xl('Squads')
54 $gacl->add_object_section('Sensitivities', 'sensitivities', 10, 0, 'ACO');
55 // xl('Sensitivities')
56 $gacl->add_object_section('Placeholder', 'placeholder', 10, 0, 'ACO');
57 // xl('Placeholder')
58 $gacl->add_object_section('Nation Notes', 'nationnotes', 10, 0, 'ACO');
59 // xl('Nation Notes')
60 $gacl->add_object_section('Patient Portal', 'patientportal', 10, 0, 'ACO');
61 // xl('Patient Portal')
62 $gacl->add_object_section('Menus', 'menus', 10, 0, 'ACO');
63 // xl('Menus')
64 $gacl->add_object_section('Groups', 'groups', 10, 0, 'ACO');
65 // xl('Groups')
69 // Create Accounting ACOs.
71 $gacl->add_object('acct', 'Billing (write optional)', 'bill', 10, 0, 'ACO');
72 // xl('Billing (write optional)')
73 $gacl->add_object('acct', 'Price Discounting', 'disc', 10, 0, 'ACO');
74 // xl('Price Discounting')
75 $gacl->add_object('acct', 'EOB Data Entry', 'eob', 10, 0, 'ACO');
76 // xl('EOB Data Entry')
77 $gacl->add_object('acct', 'Financial Reporting - my encounters', 'rep', 10, 0, 'ACO');
78 // xl('Financial Reporting - my encounters')
79 $gacl->add_object('acct', 'Financial Reporting - anything', 'rep_a', 10, 0, 'ACO');
80 // xl('Financial Reporting - anything')
82 // Create Administration ACOs.
84 $gacl->add_object('admin', 'Superuser', 'super', 10, 0, 'ACO');
85 // xl('Superuser')
86 $gacl->add_object('admin', 'Calendar Settings', 'calendar', 10, 0, 'ACO');
87 // xl('Calendar Settings')
88 $gacl->add_object('admin', 'Database Reporting', 'database', 10, 0, 'ACO');
89 // xl('Database Reporting')
90 $gacl->add_object('admin', 'Forms Administration', 'forms', 10, 0, 'ACO');
91 // xl('Forms Administration')
92 $gacl->add_object('admin', 'Practice Settings', 'practice', 10, 0, 'ACO');
93 // xl('Practice Settings')
94 $gacl->add_object('admin', 'Superbill Codes Administration', 'superbill', 10, 0, 'ACO');
95 // xl('Superbill Codes Administration')
96 $gacl->add_object('admin', 'Users/Groups/Logs Administration', 'users', 10, 0, 'ACO');
97 // xl('Users/Groups/Logs Administration')
98 $gacl->add_object('admin', 'Batch Communication Tool', 'batchcom', 10, 0, 'ACO');
99 // xl('Batch Communication Tool')
100 $gacl->add_object('admin', 'Language Interface Tool', 'language', 10, 0, 'ACO');
101 // xl('Language Interface Tool')
102 $gacl->add_object('admin', 'Pharmacy Dispensary', 'drugs', 10, 0, 'ACO');
103 // xl('Pharmacy Dispensary')
104 $gacl->add_object('admin', 'ACL Administration', 'acl', 10, 0, 'ACO');
105 // xl('ACL Administration')
106 $gacl->add_object('admin', 'Multipledb', 'multipledb', 10, 0, 'ACO');
107 // xl('Multipledb')
108 $gacl->add_object('admin', 'Menu', 'menu', 10, 0, 'ACO');
109 // xl('Menu')
110 $gacl->add_object('admin', 'Manage modules', 'manage_modules', 10, 0, 'ACO');
111 // xl('Manage modules')
114 // Create ACOs for encounters.
116 $gacl->add_object('encounters', 'Authorize - my encounters', 'auth', 10, 0, 'ACO');
117 // xl('Authorize - my encounters')
118 $gacl->add_object('encounters', 'Authorize - any encounters', 'auth_a', 10, 0, 'ACO');
119 // xl('Authorize - any encounters')
120 $gacl->add_object('encounters', 'Coding - my encounters (write,wsome optional)', 'coding', 10, 0, 'ACO');
121 // xl('Coding - my encounters (write,wsome optional)')
122 $gacl->add_object('encounters', 'Coding - any encounters (write,wsome optional)', 'coding_a', 10, 0, 'ACO');
123 // xl('Coding - any encounters (write,wsome optional)')
124 $gacl->add_object('encounters', 'Notes - my encounters (write,addonly optional)', 'notes', 10, 0, 'ACO');
125 // xl('Notes - my encounters (write,addonly optional)')
126 $gacl->add_object('encounters', 'Notes - any encounters (write,addonly optional)', 'notes_a', 10, 0, 'ACO');
127 // xl('Notes - any encounters (write,addonly optional)')
128 $gacl->add_object('encounters', 'Fix encounter dates - any encounters', 'date_a', 10, 0, 'ACO');
129 // xl('Fix encounter dates - any encounters')
130 $gacl->add_object('encounters', 'Less-private information (write,addonly optional)', 'relaxed', 10, 0, 'ACO');
131 // xl('Less-private information (write,addonly optional)')
133 // Create ACOs for lists.
135 $gacl->add_object('lists', 'Default List (write,addonly optional)', 'default', 10, 0, 'ACO');
136 // xl('Default List (write,addonly optional)')
137 $gacl->add_object('lists', 'State List (write,addonly optional)', 'state', 10, 0, 'ACO');
138 // xl('State List (write,addonly optional)')
139 $gacl->add_object('lists', 'Country List (write,addonly optional)', 'country', 10, 0, 'ACO');
140 // xl('Country List (write,addonly optional)')
141 $gacl->add_object('lists', 'Language List (write,addonly optional)', 'language', 10, 0, 'ACO');
142 // xl('Language List (write,addonly optional)')
143 $gacl->add_object('lists', 'Ethnicity-Race List (write,addonly optional)', 'ethrace', 10, 0, 'ACO');
144 // xl('Ethnicity-Race List (write,addonly optional)')
146 // Create ACOs for patientportal.
148 $gacl->add_object('patientportal', 'Patient Portal', 'portal', 10, 0, 'ACO');
149 // xl('Patient Portal')
151 // Create ACOs for modules.
153 $gacl->add_object('menus', 'Modules', 'modle', 10, 0, 'ACO');
154 // xl('Modules')
156 // Create ACOs for patients.
158 $gacl->add_object('patients', 'Appointments (write,wsome optional)', 'appt', 10, 0, 'ACO');
159 // xl('Appointments (write,wsome optional)')
160 $gacl->add_object('patients', 'Demographics (write,addonly optional)', 'demo', 10, 0, 'ACO');
161 // xl('Demographics (write,addonly optional)')
162 $gacl->add_object('patients', 'Medical/History (write,addonly optional)', 'med', 10, 0, 'ACO');
163 // xl('Medical/History (write,addonly optional)')
164 $gacl->add_object('patients', 'Transactions (write optional)', 'trans', 10, 0, 'ACO');
165 // xl('Transactions (write optional)')
166 $gacl->add_object('patients', 'Documents (write,addonly optional)', 'docs', 10, 0, 'ACO');
167 // xl('Documents (write,addonly optional)')
168 $gacl->add_object('patients', 'Documents Delete', 'docs_rm', 10, 0, 'ACO');
169 // xl('Documents Delete')
170 $gacl->add_object('patients', 'Patient Notes (write,addonly optional)', 'notes', 10, 0, 'ACO');
171 // xl('Patient Notes (write,addonly optional)')
172 $gacl->add_object('patients', 'Sign Lab Results (write,addonly optional)', 'sign', 10, 0, 'ACO');
173 // xl('Sign Lab Results (write,addonly optional)')
174 $gacl->add_object('patients', 'Patient Reminders (write,addonly optional)', 'reminder', 10, 0, 'ACO');
175 // xl('Patient Reminders (write,addonly optional)')
176 $gacl->add_object('patients', 'Clinical Reminders/Alerts (write,addonly optional)', 'alert', 10, 0, 'ACO');
177 // xl('Clinical Reminders/Alerts (write,addonly optional)')
178 $gacl->add_object('patients', 'Disclosures (write,addonly optional)', 'disclosure', 10, 0, 'ACO');
179 // xl('Disclosures (write,addonly optional)')
180 $gacl->add_object('patients', 'Prescriptions (write,addonly optional)', 'rx', 10, 0, 'ACO');
181 // xl('Prescriptions (write,addonly optional)')
182 $gacl->add_object('patients', 'Amendments (write,addonly optional)', 'amendment', 10, 0, 'ACO');
183 // xl('Amendments (write,addonly optional)')
184 $gacl->add_object('patients', 'Lab Results (write,addonly optional)', 'lab', 10, 0, 'ACO');
185 // xl('Lab Results (write,addonly optional)')
186 $gacl->add_object('patients', 'Patient Report', 'pat_rep', 10, 0, 'ACO');
187 // xl('Patient Report')
190 $gacl->add_object('groups', 'View/Add/Update groups', 'gadd', 10, 0, 'ACO');
191 // xl('View/Add/Update groups')
192 $gacl->add_object('groups', 'View/Create/Update groups appointment in calendar', 'gcalendar', 10, 0, 'ACO');
193 // xl('View/Create/Update groups appointment in calendar')
194 $gacl->add_object('groups', 'Group encounter log', 'glog', 10, 0, 'ACO');
195 // xl('Group encounter log')
196 $gacl->add_object('groups', 'Group detailed log of appointment in patient record', 'gdlog', 10, 0, 'ACO');
197 // xl('Group detailed log of appointment in patient record')
198 $gacl->add_object('groups', 'Send message from the permanent group therapist to the personal therapist', 'gm', 10, 0, 'ACO');
199 // xl('Send message from the permanent group therapist to the personal therapist')
201 // Create ACOs for sensitivities.
203 $gacl->add_object('sensitivities', 'Normal', 'normal', 10, 0, 'ACO');
204 // xl('Normal')
205 $gacl->add_object('sensitivities', 'High', 'high', 20, 0, 'ACO');
206 // xl('High')
208 // Create ACO for placeholder.
210 $gacl->add_object('placeholder', 'Placeholder (Maintains empty ACLs)', 'filler', 10, 0, 'ACO');
211 // xl('Placeholder (Maintains empty ACLs)')
213 // Create ACO for nationnotes.
215 $gacl->add_object('nationnotes', 'Nation Notes Configure', 'nn_configure', 10, 0, 'ACO');
216 // xl('Nation Notes Configure')
218 // Create ARO groups.
220 $users = $gacl->add_group('users', 'OpenEMR Users', 0, 'ARO');
221 // xl('OpenEMR Users')
222 $admin = $gacl->add_group('admin', 'Administrators', $users, 'ARO');
223 // xl('Administrators')
224 $clin = $gacl->add_group('clin', 'Clinicians', $users, 'ARO');
225 // xl('Clinicians')
226 $doc = $gacl->add_group('doc', 'Physicians', $users, 'ARO');
227 // xl('Physicians')
228 $front = $gacl->add_group('front', 'Front Office', $users, 'ARO');
229 // xl('Front Office')
230 $back = $gacl->add_group('back', 'Accounting', $users, 'ARO');
231 // xl('Accounting')
232 $breakglass = $gacl->add_group('breakglass', 'Emergency Login', $users, 'ARO');
233 // xl('Emergency Login')
236 // Create a Users section for the AROs (humans).
238 $gacl->add_object_section('Users', 'users', 10, 0, 'ARO');
239 // xl('Users')
241 // Create the Administrator in the above-created "users" section
242 // and add him/her to the above-created "admin" group.
243 // If this script is being used by OpenEMR's setup, then will
244 // incorporate the installation values. Otherwise will
245 // hardcode the 'admin' user.
246 if (isset($this) && isset($this->iuser)) {
247 $gacl->add_object('users', $this->iuname, $this->iuser, 10, 0, 'ARO');
248 $gacl->add_group_object($admin, 'users', $this->iuser, 'ARO');
249 } else {
250 $gacl->add_object('users', 'Administrator', 'admin', 10, 0, 'ARO');
251 $gacl->add_group_object($admin, 'users', 'admin', 'ARO');
254 // Declare return terms for language translations
255 // xl('write') xl('wsome') xl('addonly') xl('view')
257 // Set permissions for administrators.
259 $gacl->add_acl(
260 array(
261 'acct' => array('bill', 'disc', 'eob', 'rep', 'rep_a'),
262 'admin' => array('calendar', 'database', 'forms', 'practice', 'superbill', 'users', 'batchcom', 'language', 'super', 'drugs', 'acl','multipledb','menu','manage_modules'),
263 'encounters' => array('auth_a', 'auth', 'coding_a', 'coding', 'notes_a', 'notes', 'date_a', 'relaxed'),
264 'lists' => array('default','state','country','language','ethrace'),
265 'patients' => array('appt', 'demo', 'med', 'trans', 'docs', 'notes', 'sign', 'reminder', 'alert', 'disclosure', 'rx', 'amendment', 'lab', 'docs_rm','pat_rep'),
266 'sensitivities' => array('normal', 'high'),
267 'nationnotes' => array('nn_configure'),
268 'patientportal' => array('portal'),
269 'menus' => array('modle'),
270 'groups' => array('gadd','gcalendar','glog','gdlog','gm')
272 null,
273 array($admin),
274 null,
275 null,
278 'write',
279 'Administrators can do anything'
281 // xl('Administrators can do anything')
283 // Set permissions for physicians.
285 $gacl->add_acl(
286 array(
287 'patients' => array('pat_rep')
289 null,
290 array($doc),
291 null,
292 null,
295 'view',
296 'Things that physicians can only read'
298 // xl('Things that physicians can only read')
299 $gacl->add_acl(
300 array(
301 'placeholder' => array('filler')
303 null,
304 array($doc),
305 null,
306 null,
309 'addonly',
310 'Things that physicians can read and enter but not modify'
312 // xl('Things that physicians can read and enter but not modify')
313 $gacl->add_acl(
314 array(
315 'placeholder' => array('filler')
317 null,
318 array($doc),
319 null,
320 null,
323 'wsome',
324 'Things that physicians can read and partly modify'
326 // xl('Things that physicians can read and partly modify')
327 $gacl->add_acl(
328 array(
329 'acct' => array('disc', 'rep'),
330 'admin' => array('drugs'),
331 'encounters' => array('auth_a', 'auth', 'coding_a', 'coding', 'notes_a', 'notes', 'date_a', 'relaxed'),
332 'patients' => array('appt', 'demo', 'med', 'trans', 'docs', 'notes', 'sign', 'reminder', 'alert',
333 'disclosure', 'rx', 'amendment', 'lab'),
334 'sensitivities' => array('normal', 'high'),
335 'groups' => array('gcalendar','glog')
337 null,
338 array($doc),
339 null,
340 null,
343 'write',
344 'Things that physicians can read and modify'
346 // xl('Things that physicians can read and modify')
348 // Set permissions for clinicians.
350 $gacl->add_acl(
351 array(
352 'patients' => array('pat_rep')
354 null,
355 array($clin),
356 null,
357 null,
360 'view',
361 'Things that clinicians can only read'
363 // xl('Things that clinicians can only read')
364 $gacl->add_acl(
365 array(
366 'encounters' => array('notes', 'relaxed'),
367 'patients' => array('demo', 'med', 'docs', 'notes','trans', 'reminder', 'alert', 'disclosure', 'rx', 'amendment', 'lab'),
368 'sensitivities' => array('normal')
370 null,
371 array($clin),
372 null,
373 null,
376 'addonly',
377 'Things that clinicians can read and enter but not modify'
379 // xl('Things that clinicians can read and enter but not modify')
380 $gacl->add_acl(
381 array(
382 'placeholder' => array('filler')
384 null,
385 array($clin),
386 null,
387 null,
390 'wsome',
391 'Things that clinicians can read and partly modify'
393 // xl('Things that clinicians can read and partly modify')
394 $gacl->add_acl(
395 array(
396 'admin' => array('drugs'),
397 'encounters' => array('coding'),
398 'patients' => array('appt'),
399 'groups' => array('gcalendar','glog')
401 null,
402 array($clin),
403 null,
404 null,
407 'write',
408 'Things that clinicians can read and modify'
410 // xl('Things that clinicians can read and modify')
412 // Set permissions for front office staff.
414 $gacl->add_acl(
415 array(
416 'patients' => array('alert','pat_rep')
418 null,
419 array($front),
420 null,
421 null,
424 'view',
425 'Things that front office can only read'
427 // xl('Things that front office can only read')
428 $gacl->add_acl(
429 array(
430 'placeholder' => array('filler')
432 null,
433 array($front),
434 null,
435 null,
438 'addonly',
439 'Things that front office can read and enter but not modify'
441 // xl('Things that front office can read and enter but not modify')
442 $gacl->add_acl(
443 array(
444 'placeholder' => array('filler')
446 null,
447 array($front),
448 null,
449 null,
452 'wsome',
453 'Things that front office can read and partly modify'
455 // xl('Things that front office can read and partly modify')
456 $gacl->add_acl(
457 array(
458 'patients' => array('appt', 'demo', 'trans', 'notes'),
459 'groups' => array('gcalendar')
461 null,
462 array($front),
463 null,
464 null,
467 'write',
468 'Things that front office can read and modify'
470 // xl('Things that front office can read and modify')
472 // Set permissions for back office staff.
474 $gacl->add_acl(
475 array(
476 'patients' => array('alert','pat_rep')
478 null,
479 array($back),
480 null,
481 null,
484 'view',
485 'Things that back office can only read'
487 // xl('Things that back office can only read')
488 $gacl->add_acl(
489 array(
490 'placeholder' => array('filler')
492 null,
493 array($back),
494 null,
495 null,
498 'addonly',
499 'Things that back office can read and enter but not modify'
501 // xl('Things that back office can read and enter but not modify')
502 $gacl->add_acl(
503 array(
504 'placeholder' => array('filler')
506 null,
507 array($back),
508 null,
509 null,
512 'wsome',
513 'Things that back office can read and partly modify'
515 // xl('Things that back office can read and partly modify')
516 $gacl->add_acl(
517 array(
518 'acct' => array('bill', 'disc', 'eob', 'rep', 'rep_a'),
519 'admin' => array('practice', 'superbill'),
520 'encounters' => array('auth_a', 'coding_a', 'date_a'),
521 'patients' => array('appt', 'demo')
523 null,
524 array($back),
525 null,
526 null,
529 'write',
530 'Things that back office can read and modify'
532 // xl('Things that back office can read and modify')
534 // Set permissions for Emergency Login.
536 $gacl->add_acl(
537 array(
538 'acct' => array('bill', 'disc', 'eob', 'rep', 'rep_a'),
539 'admin' => array('calendar', 'database', 'forms', 'practice', 'superbill', 'users', 'batchcom', 'language', 'super', 'drugs', 'acl','multipledb','menu','manage_modules'),
540 'encounters' => array('auth_a', 'auth', 'coding_a', 'coding', 'notes_a', 'notes', 'date_a', 'relaxed'),
541 'lists' => array('default','state','country','language','ethrace'),
542 'patients' => array('appt', 'demo', 'med', 'trans', 'docs', 'notes', 'sign', 'reminder', 'alert', 'disclosure', 'rx', 'amendment', 'lab', 'docs_rm','pat_rep'),
543 'sensitivities' => array('normal', 'high'),
544 'nationnotes' => array('nn_configure'),
545 'patientportal' => array('portal'),
546 'menus' => array('modle'),
547 'groups' => array('gadd','gcalendar','glog','gdlog','gm')
549 null,
550 array($breakglass),
551 null,
552 null,
555 'write',
556 'Emergency Login user can do anything'
558 // xl('Emergency Login user can do anything')
561 <html>
562 <head>
563 <title>OpenEMR ACL Setup</title>
564 <link rel=STYLESHEET href="interface/themes/style_blue.css">
565 </head>
566 <body>
567 <b>OpenEMR ACL Setup</b>
568 <br />
569 All done configuring and installing access controls (php-GACL)!
570 </body>
571 </html>