Introduction

Our roles are designed to associate with any number of functions. Where the security actually happens is implemented on each view individually.

Each view has a ‘security’ custom property that’s based on the roles that the user has, and which functions those roles are able to perform. In the case of the asset editor for example, it will be looking at the configureAssets function, and the assets that are included with it. These are the assets that the user will have clearance to configure assets for. In this case, the user has the ability to configure assets for Kanoa Industries\NewSite, and any children assets under it.

The second part of the security check, is another custom property called userAction.

Because security is asset based, this binding to ‘userAction’ is fired whenever a selected asset is changed. Here we’ve selected the NewSite asset, and the fields in the editor are enabled. In order to restrict parts of the views, bindings are configured to check against the userAction property’s corresponding fields. In this case, each of the input fields have their ‘enabled’ property bound to userAction’s canUpdate.

Now we select Jacksonville Juices, which is an asset we don’t have as an asset under our configureAssets. The input fields are all disabled, and additionally some action buttons on the far left do not appear.

In summary, security is implemented specifically on each view by this common pattern. Each view will generate the user’s security information, and along with each asset per role function. Views will then restrict certain actions based on the user’s security information and the selected asset. Users with the gatewayAdmin role bypass these checks and are allowed to perform any action.

In the following sections, each security function will be broadly explained, followed by the specific views that the function pertains to.

Functions Overview

In this section, each security function will be summarized, with its main functionalities explained. Specific views that each function will be checked against will be listed in the “Function Views” section later on.

Configure Security

Configuring security pertains to everything associated with the security table view.

Users with a role that comes with the Configure Security function may create, edit and delete users in the “Users” tab.

The “Roles” tab is viewable by anyone, but only editable by users with the “Gateway Admin” role.

The “Configuration” tab is only viewable and editable by users with the “Gateway Admin” role.

Configure Assets

Assets are a very essential part of MES, so many views apart from the main asset editor view check against the “Configure Assets” function.

This is the main view where asset configuration most directly happens. Users with the “Configure Assets” function may create, edit, and delete assets, for all allowed assets and their children assets. Assets that are not included in the user’s permissions are still viewable but changes cannot be made to them.

This is the primary functionality of ‘Configure Assets’, but this function is also used throughout various other asset-related views.

Configure Items

Items are sometimes asset-independent, so item configuring doesn’t always check against a selected asset. As long as a user has “Configure Items” as one of their role functions, they will be able to perform any action within this view, which includes adding, editing, and deleting in any of the three tabs.

Item state configuration is also checked against “Configure Items”, allowing full permissions if the user has the function enabled for them. Item state link configuration is instead checked against “Configure Assets”

Operate Assets

As the name of the function suggests, “Operate Assets” is the function that determines if users can perform operations on an asset. This includes actions like starting a run, scheduling an operation, and editing downtime states. Security will check against the selected asset and determine if permissions are allowed.

Configure Quality

“Configure Quality” is used as a general function to check security against, pertaining to any of the QDS related views, such as the Check Sheet Editor or the Attributes Editor.

Check sheets are not asset-specific, so the user may create, edit, and delete check sheets along as any of their roles have the “Configure Quality” function.

Attributes themselves are not asset-specific, but assigning attribute details is.

Enter Checks

This function directly pertains to entering checks into a check sheet.

Approve Checks

This function allows for users with the ‘Approve Checks’ function to approve check sheets.

Schedule Shifts

This function allows for users with the ‘Schedule Shifts’ function to schedule shifts for an asset.

Users with the function may create, edit, and delete shifts.

Schedule Operations

This function allows for users with the ‘Schedule Operations’ function to schedule operations for an asset.

Users with the function may create, edit, and delete events.

Function Views Glossary

In this glossary, each security function will list out all views that check against the function.

Configure Security

Users

kanoa/core/config/security/securityTable

Edit User

kanoa/core/config/security/embedded/userEdit

Configure Assets

Lot Configuration

kanoa/mes/config/lots/lotConfiguration

This view is an example where one view may have several different ‘userAction’ objects, since the logic and bindings may be different.

Dynamic Attributes

kanoa/mes/config/attributes/attributes

Dynamic Attribute Detail Editor

kanoa/mes/config/attributes/attributeDetailsEditor

Item States

kanoa/mes/config/itemStates/itemStateConfiguration

Assets

kanoa/mes/config/assets/assetTreeEditor

Configure Items

Materials

• kanoa/mes/config/items/itemManager
• kanoa/mes/config/items/inputMaterials
• kanoa/mes/config/items/itemRates

Item States

• kanoa/mes/config/itemStates/itemStateConfiguration

Operate Assets

• kanoa/core/dbp/dashboards/folderEditor
• kanoa/core/dbp/dashboards/dashboardEditor
• kanoa/core/dbp/marquee/themeSelector
• kanoa/core/dbp/marquee/marqueeSelector
• kanoa/core/dbp/marquee/marqueeDashboardTable
• kanoa/core/dbp/marquee/marqueeTable
• kanoa/mes/asset/operation/evRunControl
• kanoa/mes/asset/operation/stationPanel
• kanoa/mes/asset/operation/assetOperationPanel

Configure Quality

• kanoa/core/config/alertGroupEditor
• kanoa/core/images/imageMain
• kanoa/qds/config/attributes/attributeDetailsEditor
• kanoa/qds/config/attributes/attributes
• kanoa/qds/config/checks/chkShtEditor
• kanoa/qds/config/checks/chkShtTable
• kanoa/qds/config/itemSets/itemSetsMain
• kanoa/qds/images/imageMain
• kanoa/qds/mobile/chkShtEvent/editor/root/…/btnLock
• kanoa/qds/mobile/schedule/chkSchedule
• kanoa/qds/qdsDashboard
• kanoa/qds/schedule/chkShtEventEditor/root/…btnEditMode and btnLock
• kanoa/qds/templates/selectors/engUnitSelector

Enter Checks

• kanoa/qds/config/checks/chkShtEditor
• kanoa/qds/mobile/chkShtEvent/editor
• kanoa/qds/schedule/chkShtEventEditor
• kanoa/qds/schedule/chkShtEvents

Approve Checks

kanoa/qds/schedule/chkShtEventEditor/…btnApprove

Schedule Shifts

kanoa/scheduler/shifts

Schedule Operations

kanoa/scheduler/operations