Skip to content

Commit 4918e04

Browse files
JulusianJulusian
committed
chore: update documentation
1 parent c4b8da5 commit 4918e04

File tree

2 files changed

+37
-24
lines changed

2 files changed

+37
-24
lines changed

‎packages/documentation/docs/user-guide/configuration/sofie-core-settings.md‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -87,12 +87,11 @@ There are various settings you can set for an installation. See the list below:
8787

8888
| **Field name** | Use | Default value |
8989
| :---------------------------- | :---------------------------------------------------------------------------------------------------------------------------- | :------------------------------------- |
90-
| `defaultToCollapsedSegments` | Should all segments be collapsed by default, until the user expands them | `false` |
9190
| `autoRewindLeavingSegment` | Should segments be automatically rewound after they stop playing | `false` |
9291
| `disableBlurBorder` | Should a border be displayed around the Rundown View when it's not in focus and studio mode is enabled | `false` |
9392
| `defaultTimeScale` | An arbitrary number, defining the default zoom factor of the Timelines | `1` |
9493
| `allowGrabbingTimeline` | Can Segment Timelines be grabbed to scroll them? | `true` |
95-
| `enableUserAccounts` | Enables User Accounts and Authentication. If disabled, all user stations will be treated as a single, anonymous user | `false` |
94+
| `enableHeaderAuth` | If true, enable http header based security measures. See [here](../features/access-levels) for details on using this | `false` |
9695
| `defaultDisplayDuration` | The fallback duration of a Part, when it's expectedDuration is 0. \_\_In milliseconds | `3000` |
9796
| `allowMultiplePlaylistsInGUI` | If true, allows creation of new playlists in the Lobby Gui (rundown list). If false; only pre-existing playlists are allowed. | `false` |
9897
| `followOnAirSegmentsHistory` | How many segments of history to show when scrolling back in time (0 = show current segment only) | `0` |

‎packages/documentation/docs/user-guide/features/access-levels.md‎

Lines changed: 36 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,46 +1,60 @@
11
---
22
sidebar_position: 3
33
---
4+
45
# Access Levels
56

6-
A variety of access levels can be set via the URL. By default, a user cannot edit settings, nor play out anything. Some of the access levels provide additional administrative pages or helpful tool tips for new users. These modes are persistent between sessions and will need to be manually disabled by replacing the _1_ with a _0_ in the URL. Below is a quick reference to the modes and what they have access to.
7+
## Permissions
78

8-
If user accounts are enabled \(`enableUserAccounts` in [_Sofie Core_ settings](../configuration/sofie-core-settings#settings-file)\), the access levels are set under the user settings. If no user accounts are set, the access level for a browser is set by adding `?theaccessmode=1` to the URL as described below.
9+
There are a few different access levels that users can be assigned. They are not heirarchical, you will often need to enable multiple for each user.
10+
Any client that can access sofie always has at least view-only access to the rundowns, and system status pages.
911

10-
The access level is persisted in browser's Local Storage. To disable, visit`?theaccessmode=0`.
12+
| Level | Summary |
13+
| :------------ | :----------------------------------------------------------------------------------------------------------------------------------------------- |
14+
| **studio** | Grants access to operate a studio for playout of a rundown. |
15+
| **configure** | Grants access to the settings pages of Sofie, and other abilities to configure the system. |
16+
| **developer** | Grants access to some tools useful to developers. This also changes some ui behaviours to be less agressive in what is shown in the rundown view |
17+
| **testing** | Enables the page Test Tools, which contains various tools useful for testing the system during development |
18+
| **service** | Grants access to the external message status page, and some additional rundown management options that are not commonly needed |
19+
| **gateway** | Grants access to various APIs intended for use by the various gateways that connect Sofie to other systems. |
1120

12-
| Access area | Basic Mode | Configuration Mode | Studio Mode | Admin Mode |
13-
| :--- | :--- | :--- | :--- | :--- |
14-
| **Rundowns** | View Only | View Only | Yes, playout | Yes, playout |
15-
| **Settings** | No | Yes | No | Yes |
21+
## Authentication providers
1622

23+
There are two ways to define the access for each user, which to use depends on your security requirements.
1724

18-
### Basic mode
25+
### Browser based
1926

20-
Without enabling any additional modes in Sofie, the browser will have minimal access to the system. It will be able to view a rundown but, will not have the ability to manipulate it. This includes activating, deactivating, or resetting the rundown as well as taking the next part, adlib, etc.
27+
:::info
2128

22-
### Studio mode
29+
This is a simple mode that relies on being able to trust every client that can connect to Sofie
2330

24-
Studio Mode gives the current browser full control of the studio and all information associated to it. This includes allowing actions like activating and deactivating rundowns, taking parts, adlibbing, etc. This mode is accessed by adding a `?studio=1` to the end of the URL.
31+
:::
2532

26-
### Configuration mode
33+
In this mode, a variety of access levels can be set via the URL. The access level is persisted in browser's Local Storage.
2734

28-
Configuration mode gives the user full control over the Settings pages and allows full access to the system including the ability to modify _Blueprints_, _Studios_, or _Show Styles_, creating and restoring _Snapshots_, as well as modifying attached devices.
35+
By default, a user cannot edit settings, nor play out anything. Some of the access levels provide additional administrative pages or helpful tool tips for new users. These modes are persistent between sessions and will need to be manually enabled or disabled by appending a suffix to the url.
36+
Each of the modes listed in the levels table above can be used here, such as by navigating to `https://my-sofie/?studio=1` to enable studio mode, or `https://my-sofie/?studio=0` to disable studio mode.
2937

30-
### Help Mode
38+
There are some additional url parameters that can be used to simplify the granting of permissions:
3139

32-
Enables some tooltips that might be useful to new users. This mode is accessed by adding `?help=1` to the end of the URL.
40+
- `?help=1` will enable some tooltips that might be useful to new users.
41+
- `?admin=1` will give the user the same access as the _Configuration_ and _Studio_ modes as well as having access to a set of _Test Tools_ and a _Manual Control_ section on the Rundown page.
3342

34-
### Admin Mode
43+
### Header based
3544

36-
This mode will give the user the same access as the _Configuration_ and _Studio_ modes as well as having access to a set of _Test Tools_ and a _Manual Control_ section on the Rundown page.
45+
:::danger
3746

38-
This mode is enabled when `?admin=1` is added the end of the URL.
47+
This mode is very new and could have some undiscovered holes.
48+
It is known that secrets can be leaked to all clients who can connect to Sofie, which is not desirable.
3949

40-
### Testing Mode
50+
:::
4151

42-
Enables the page Test Tools, which contains various tools useful for testing the system during development. This mode is enabled when `?testing=1` is added the end of the URL.
52+
In this mode, we rely on Sofie being run behind a reverse-proxy which will inform Sofie of the permissions of each connection. This allows you to use your organisations preferred auth provider, and translate that into something that Sofie can understand.
53+
To enable this mode, you need to enable the `enableHeaderAuth` property in the [settings file](../configuration/sofie-core-settings.md)
4354

44-
### Developer Mode
55+
Sofie expects that for each DDP connection or http request, the `dnt` header will be set containing a comma separated list of the levels from the above table. If the header is not defined or is empty, the connection will have view-only access to Sofie.
56+
This header can also contain simply `admin` to grant the connection permission to everything.
57+
We are using the `dnt` header due to limitations imposed by Meteor, but intend this to become a proper header name in a future release.
4558

46-
This mode will enable the browsers default right click menu to appear and can be accessed by adding `?develop=1` to the URL. It will also reveal the Manual Control section on the Rundown page.
59+
When in this mode, you should make sure that Sofie can only be accessed through the reverse proxy, and that the reverse-proxy will always override any value sent by a client.
60+
Because the value is defined in the http headers, it is not possible to revoke permissions for a user who currently has the ui open. If this is necessary to do, you can force the connection to be dropped by the reverse-proxy.

0 commit comments

Comments
 (0)