Skip to content

[Discounts] Discount policies #2771

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 6 commits into from
Jun 11, 2025
Merged

[Discounts] Discount policies #2771

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
4ea17ed
Permissions
mnocon Jun 4, 2025
8f453c8
Build fixes
mnocon Jun 5, 2025
02cd196
Fixed links
mnocon Jun 9, 2025
684e2ea
Fixed last links
mnocon Jun 9, 2025
c3f7666
Removed link
mnocon Jun 9, 2025
e4424b5
Apply suggestions from code review
mnocon Jun 11, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/administration/recent_activity/recent_activity.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ For every exact hour, the cronjob line is:
## Permission and security

The [`activity_log/read`](policies.md#activity-log) policy gives a role the access to the **Admin** -> **Activity list**, the dashboard's **Recent activity** block, and the user profile's **Recent activity**.
It can be limited to "Only own logs" ([`ActivityLogOwner`](limitation_reference.md#activitylogowner-limitation)).
It can be limited to "Only own logs" ([`ActivityLogOwner`](limitation_reference.md#activity-log-owner-limitation)).

The policy should be given to every roles having access to the back office, at least with the `ActivityLogOwner` owner limitation, to allow them to use the "Recent activity" block in the [default dashboard](configure_default_dashboard.md) or their [custom dashboard](customize_dashboard.md).
This policy is required to view [activity log in user profile]([[= user_doc =]]/getting_started/get_started/#view-and-edit-user-profile), if [profile is enabled](update_from_4.5.md#user-profile).
Expand Down
18 changes: 14 additions & 4 deletions docs/permissions/limitation_reference.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,17 +33,17 @@ Out of the box FunctionList uses it in the following way:
- {name: ibexa.permissions.limitation_type, alias: FunctionList}
```

## ActivityLogOwner limitation
## Activity log Owner limitation

The `ActivityLogOwner` limitation specifies if a user can see only their own [recent activity](recent_activity.md) log entries, and not entries from other users.
The Activity log Owner (`ActivityLogOwner`) limitation specifies if a user can see only their own [recent activity](recent_activity.md) log entries, and not entries from other users.

| Value | UI value | Description |
|-------|-----------------|--------------------------------------------------------------|
| `1` | "Only own logs" | Current user can only access their own activity log entries. |

## CartOwner limitation
## Cart Owner limitation

The `CartOwner` limitation specifies whether the user can modify a cart.
The Cart Owner (`CartOwner`) limitation specifies whether the user can modify a cart.

### Possible values

Expand All @@ -62,6 +62,16 @@ The Change Owner (`ChangeOwner`) limitation specifies whether the user can chang
|------|------|------|
|`1`|"Forbid"|The user cannot change owner of a content item|

## Discount Owner limitation [[% include 'snippets/lts-update_badge.md' %]] [[% include 'snippets/commerce_badge.md' %]]

The Discount Owner (`DiscountOwner`) limitation specifies whether the user can interact with a [discount](discounts.md).

### Possible values

|Value|UI value|Description|
|------|------|------|
|"self"|"self"|Only the user who is the owner of the discount gets access.|

## Content type Group limitation

The Content Type Group (`UserGroup`) limitation specifies that only users with at least one common *direct* user group with the owner of content get the selected access right.
Expand Down
16 changes: 16 additions & 0 deletions docs/permissions/permission_use_cases.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -269,6 +269,22 @@ Set the following permissions to decide what actions are available when users in
- `checkout/update` - to allow users to modify existing information, for example item quantity
- `checkout/delete` - to delete checkout

### Discount management [[% include 'snippets/lts-update_badge.md' %]]

Set the following permissions to decide what actions are available when users interact with [discounts](discounts.md) in the back office:

- `discount/create` - to allow the user to create a new discount
- `discount/update` - to allow the user to change the parameters of an existing discount
- `discount/view` - to allow the user to view discounts data
- `discount/delete` - to delete an existing discount
- `discount/enable` - to allow the user to enable an existing discount
- `discount/disable` - to allow the user to disable an existing discount

To further control access to a discount, you can use the `DiscountOwner` limitation and set its value to `self`.
This way users can only interact with their own discounts.

Store users do not need any permissions to use discounts in the buying process.

### Order management

Set the following permissions to decide what actions are available when users interact with orders:
Expand Down
31 changes: 25 additions & 6 deletions docs/permissions/policies.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,9 +27,9 @@ Each role you assign to user or user group consists of policies which define, wh

| Module | Function | Effect | Possible Limitations |
|------------------------------|--------------------|----------------------|-------------------------------------------------------------------------|
| <nobr>`activity_log`</nobr> | <nobr>`read`</nobr> | access activity list | [ActivityLogOwner](limitation_reference.md#activitylogowner-limitation) |
| <nobr>`activity_log`</nobr> | <nobr>`read`</nobr> | access activity list | [ActivityLogOwner](limitation_reference.md#activity-log-owner-limitation) |

#### AI actions
#### AI actions [[% include 'snippets/lts-update_badge.md' %]]

| Module | Function | Effect | Possible Limitations |
|-------------------------------------|------------------------|------------------------|----------------------|
Expand Down Expand Up @@ -103,10 +103,10 @@ Each role you assign to user or user group consists of policies which define, wh

| Module | Function | Effect | Possible limitations |
|---------------------|-----------------------|---------------------------------------------------------------------|-----------------------------------------------------------|
| <nobr>`cart`</nobr> | <nobr>`create`</nobr> | create a cart | [CartOwner](limitation_reference.md#cartowner-limitation) |
| | <nobr>`delete`</nobr> | delete cart, for example, after successful checkout | [CartOwner](limitation_reference.md#cartowner-limitation) |
| | <nobr>`edit`</nobr> | change cart metadata (name, currency, owner), add/remove cart items | [CartOwner](limitation_reference.md#cartowner-limitation) |
| | <nobr>`view`</nobr> | view a cart | [CartOwner](limitation_reference.md#cartowner-limitation) |
| <nobr>`cart`</nobr> | <nobr>`create`</nobr> | create a cart | [CartOwner](limitation_reference.md#cart-owner-limitation) |
| | <nobr>`delete`</nobr> | delete cart, for example, after successful checkout | [CartOwner](limitation_reference.md#cart-owner-limitation) |
| | <nobr>`edit`</nobr> | change cart metadata (name, currency, owner), add/remove cart items | [CartOwner](limitation_reference.md#cart-owner-limitation) |
| | <nobr>`view`</nobr> | view a cart | [CartOwner](limitation_reference.md#cart-owner-limitation) |

#### Checkout [[% include 'snippets/commerce_badge.md' %]]

Expand All @@ -124,6 +124,25 @@ Each role you assign to user or user group consists of policies which define, wh
| <nobr>`commerce`</nobr> | <nobr>`currency`</nobr> | manage currencies |
| | <nobr>`region`</nobr> | manage regions |

#### Discounts [[% include 'snippets/lts-update_badge.md' %]] [[% include 'snippets/commerce_badge.md' %]]

The discount policies decide which actions can be executed by given user or user group.

!!! caution "Customers and discount policies"

Customers don't need any policies to use the discounts on the [storefront](storefront.md).
Even the `discount/view` policy would allow them to access all the discount details, including the coupon codes to activate them, which could lead to system abuse.


| Module | Function | Effect | Possible limitations |
|----------------------|--------------------------|-----------------------------|----------------------------------------------------|
| <nobr>`discount`</nobr> | <nobr>`create`</nobr> | create a discount | [DiscountOwner](limitation_reference.md#discount-owner-limitation) |
| | <nobr>`update`</nobr> | modify discount parameters | [DiscountOwner](limitation_reference.md#discount-owner-limitation) |
| | <nobr>`view`</nobr> | view discounts (including its details) | [DiscountOwner](limitation_reference.md#discount-owner-limitation) |
| | <nobr>`delete`</nobr> | delete a discount | [DiscountOwner](limitation_reference.md#discount-owner-limitation) |
| | <nobr>`enable`</nobr> | enable a discount | [DiscountOwner](limitation_reference.md#discount-owner-limitation) |
| | <nobr>`disable`</nobr> | disable a discount | [DiscountOwner](limitation_reference.md#discount-owner-limitation) |

#### Orders [[% include 'snippets/commerce_badge.md' %]]

| Module | Function | Effect | Possible limitations |
Expand Down