Skip to content

6.2.2.10 UserGroupRoleAssignment

6.2.2.10.1 Purpose

Gives a role to a group, either in its own Organization or, through a delegation, in the delegator. The second case is what makes groups worth having for a cooperative: one assignment per member farm gives the whole Technicians group the delegated role there, instead of one delegated membership per technician per farm. access expands groups and publishes each user's effective memberships, so the other systems keep the same cached copy as before and never see a group.

6.2.2.10.2 Questions it answers

  • Which roles does this group hold, and in which Organizations?
  • Which delegated roles reach the members of a group through a delegation?
  • What happens to a group's roles when the delegation or the group ends?

6.2.2.10.3 Fields

Field Type Cardinality Description
id string (uuid) 1..1 Key.
group UserGroup 1..1
assigner User 1..1 Needs access.groups.manage and, as for a user, may give only roles they outrank and whose capabilities they all hold (OrganizationRoleAccessControl.priority); never to a group they belong to.
revoked_at datetime 0..1
revoked_by User 0..1
system_version SystemVersion 1..1
created_at datetime 1..1
updated_at datetime 1..1

6.2.2.10.4 Subtypes

Discriminator type: every UserGroupRoleAssignment is exactly one of the subtypes below (disjoint and complete).

DirectGroupRole

Field Type Cardinality Description
role OrganizationRoleAccessControl 1..1 Applies in the group's Organization. Never Owner or Sync Client (OrganizationPredefinedRoleEnum).

DelegatedGroupRole

Field Type Cardinality Description
delegation OrganizationDelegationMembership 1..1 The group's Organization must be the delegation's delegatee; Organization and role are those of the delegation.
A cooperative gives its Technicians group the delegated role of every member farm with one row per farm, instead of one DelegatedMembership per technician per farm.

6.2.2.10.5 Relationships

References

Uses types

SystemVersion

Subtypes

6.2.2.10.6 Rules & constraints

  • A role given to a group, in its own Organization or, through a delegation, in the delegator.
  • (group, role) is unique among active DirectGroupRoles; (group, delegation) is unique among active DelegatedGroupRoles.
  • When a delegation is revoked, its DelegatedGroupRoles are revoked too; when a group is archived, all its assignments are.