Explorer: Rights and Security

• Undefined type

This document explains how to enable and use tree editing in Immersive Explorer. It is intended for integrators, Immersive administrators, and authorized users.

It only deals with the use of the interface: activating commands, assigning rights, creating, modifying and deleting an Immersive folder.

1. General principle

Edit mode is based on two additional conditions:

1. The integrator requests the display of the editing functions with EnableEditing: true ;
2. the logged-in user has the necessary right to the Immersive folder in question.

The command bar can offer:

• New Folder ;
• Edit ;
• Delete ;
• Refresh.

Unauthorized commands are not displayed. Checks are also performed when opening the panel and then during saving.

2. Enable editing with EnableEditing

Edit mode is disabled by default in the JavaScript library.

const explorer = new MediaExplorer(
    document.getElementById("MediaExplorerHost"),
    {
        RootFolderIdentifier: 15,
        EnableEditing: true
    }
);

await explorer.initialize();

The Explorer page provided by RestFrontage already enables this mode. A client application must explicitly enable it when it builds the component itself.

EnableEditing	User rights	Result in the interface
false or absent	any	Edit controls are hidden. Refresh remains available.
true	No right to modify	Unauthorized commands remain hidden.
true	one or more rights	Only commands that match these rights are displayed.

3. Rights used by the Explorer

The rights are for the current Immersive folder.

Law	Flag	Effect in the Explorer
Folder See	1	Allows the folder to be displayed.
Folder Read	3	Allows viewing of the contents of the folder.
Folder Modify	5	Poster Edit and authorizes the modification of the name and description.
Folder Write	11	Poster New Folder and authorizes the creation of a child. This right will also be used to add media when it becomes available.
Folder FullControl	15	Poster Delete and includes all the previous rights.

Rights Modify and Write Serve different needs: A user who has permission to create a child may not have permission to rename the parent folder.

3.1 Always-Authorized Users

The following profiles have all the controls for managing Immersive folders:

• Cerebrates;
• Global Group Members Administrators the day-to-day organization;
• Global Group Members DomainAdministrators on the current server.

This rule is independent of EnableEditing. To see the commands, the option must still be active in the component.

3.2 Blob Folders

An Immersive folder with a Blob Virtual Path becomes a read-only edit point.

In this folder and its Blob tree:

• New Folder, Edit and Delete are not offered;
• Refresh and navigation remain available;
• Immersive Folder edit rights do not allow you to edit the contents of the Blob from Explorer.

4. Prepare an organization's rights

Rights are assigned on an organization-wide basis. The recommended method is to use permission groups and then place users in the groups that correspond to their role.

4.1 Check the security structure

In RestFrontage:

1. Open Security ;
2. Open Security Tools ;
3. in Security structure of organizations, select Start the audit ;
4. monitor the organization concerned;
5. if its condition is Incomplete, use Regularize.

Regularization creates only the missing standard items. It preserves existing users, groups, memberships, and entitlements.

The organization must have:

• One unit Groups ;
• One unit Users ;
• Groups Administrators and Users ;
• an organization administrator who is a member of Administrators.

4.2 Choosing a permission group

Recognized permission groups for records follow the following convention:

Organization Group	Advised Role
Folder SeeFolder	See the folders without consulting their contents.
Folder ReadFolder	Consult the tree structure and the media.
Folder ModifyFolder	Change the name and description of the folders.
Folder WriteFolder	Create subfolders.
Folder FullControlFolder	Fully administer records, including their deletion.

These groups must be placed in the unit Groups of the organization in question. If they don't exist, a security administrator can create them from Security Explorer by respecting their exact name.

4.3 Adding a User to a Group

Two paths are possible in the interface.

From the user

1. Open Security, then Users and groups ;
2. Select the user.
3. in the area Groups, choose Manage Groups ;
4. Add the necessary permission group(s).
5. Validate the panel.

From the group

1. Open Security, then Users and groups ;
2. Select the permission group.
3. in the area Members, choose Manage Members ;
4. Select Add a member ;
5. Choose which users or groups to add.
6. Validate with Add to cart.

Groups can be used as members to assign the same role to multiple users.

4.4 Apply rights to existing folders

Adding a user to a group is only sufficient if the group already has a right to the folders in question.

To check and complete automatic rights:

1. Open Security, then Security Tools ;
2. in Automatic rights of existing objects, select Start the audit ;
3. Choose the object type Folders ;
4. Select the organization.
5. Choose Refresh ;
6. check the status of each file;
7. Use Regularize on a folder or Regularize the selection for several cases.

Status	Meaning	Recommended action
Sold out	All the expected automatic rights are present.	None.
Incomplete	One or more automatic rights are missing.	Use Regularize.
Configuration	The rights policy or organization cannot be resolved.	Correct the configuration before re-auditing.

The adjustment only adds the missing automatic rights. It does not remove the other existing rights.

4.5 New File Fees

When a folder is created, the organization's automatic rights are applied to it immediately.

The recommended policy is:

Beneficiary	Recommended right
Group Users of the organization	Folder Read
Group Administrators of the organization	Folder FullControl
Specialized Permission Group	right corresponding to the name of the group

The definition of this policy is a server operation operation. The HMI Automatic rights of existing objects allows it to be controlled and enforced, but does not serve to invent or modify the policy itself.

5. Explorer Command Bar

The command bar is above the tree and content.

Order	Display Condition	Action
New Folder	EnableEditing: true and law Folder Write on the current file.	Open the panel Create a folder.
Edit	EnableEditing: true and law Folder Modify on the current file.	Open the panel Edit Folder.
Delete	EnableEditing: true and law Folder FullControl on the current file.	Open the panel Delete Folder.
Refresh	Always available	Reloads the tree view and current content.

In the general root of the Explorer, only New Folder and Refresh can be proposed. The general root is not an Immersive folder, so it cannot be modified or deleted.

A non-admin user can create in this root if they have Folder Write on at least one root folder in the organization. The new folder is created in the current organization.

6. "Create Folder" Panel

The New Folder opens a panel without reloading the page.

The subtitle indicates where you want to create:

• in the current Immersive folder.
• or at the root of the current organization.

Field	Required	Description
Name	Yes	The name of the new Immersive folder.
Description	No	Text describing the use of the file.
Blob Virtual Path	No	The root URL of a Blob container. If populated, the folder becomes a read-only mount point.

Available actions:

• Create Saves the folder and then refreshes the Explorer.
• Cancel Closes the panel without modification.

If there is an error, the panel remains open and displays the message. The content already entered is retained to allow for correction.

7. "Edit Folder" Panel

The Edit acts on the currently open Immersive folder.

The panel first presents two non-editable references:

Reference	Usage
Immersive Folder ID	Value to be used in RootFolderIdentifier.
Relative path from root	Value to be used in RelativePath. A root folder displays an empty value.

Each reference has a copy icon. This allows you to copy the value directly without giving the impression that it is editable.

The editable fields are:

• Name ;
• Description.

Available actions:

• Save Applies the changes and then refreshes the tree, breadcrumbs, and content.
• Cancel Closes the panel without modification.

The relative path displayed is calculated from the root of the Explorer. It can therefore vary depending on the RootFolderIdentifier used by the integration.

8. "Delete Folder" Panel

The Delete opens a confirmation panel.

8.1 Empty Folder

The sign indicates that the operation is final.

• Delete confirms the operation;
• Cancel Closes the panel without modification.

After deletion, the Explorer returns to the folder's parent and refreshes the tree.

8.2 Non-Empty Folder

Deletion is denied if the folder still contains:

• An Immersive subfolder.
• an Immersive media.

The panel then displays a warning and only offers Close. The file must be emptied before starting again.

9. Refresh after a change in rights

After a change of group or regularization of rights:

1. return to the Explorer;
2. Use Refresh ;
3. if necessary, reopen the file concerned.

A reconnection may be required if group membership is maintained in the current session.

10. Troubleshooting

No edit button appears

Check successively:

• that EnableEditing is worth true ;
• that the user is authenticated;
• that he belongs to the right group in the organization of the file;
• that the audit of the rights of the file indicates Sold out ;
• The current folder is not a Blob mount point.
• that the client integration loads the expected panel infrastructure.

"New Folder" appears but "Edit" does not

User owns Folder Write, but not Folder Modify. Add the changegroup if renaming should be allowed.

"Edit" appears but "Delete" does not

User owns Folder Modify, but not Folder FullControl. Removal voluntarily requires the highest level.

The removal panel denies the operation

The folder still contains a subfolder or Immersive media. Delete or move its contents before starting over.

Buttons do not evolve after a change of rights

• Use Refresh ;
• reopen the file;
• Sign out and then sign back in if the group membership has changed.
• Relaunch the automatic rights audit.

11. Commissioning Checklist

• EnableEditing is enabled only in integrations that need to offer the edition.
• The organization has a comprehensive security structure.
• The necessary Folder permission groups exist in the unit Groups of the organization.
• Users are members of the groups that correspond to their role.
• The default policy assigns reading to users and full control to organization administrators.
• The audit Automatic rights of existing objects is complete for the type Folders.
• Blob folders are still used as read-only.
• Creating, editing, deleting an empty folder, and rejecting a non-empty folder were tested.
• The display was controlled on a computer and on a small resolution.