Rights Storage
Explanation
The rights grid of the administration is an editor for XObjects stored on the wiki pages themselves. Knowing which page holds which object explains why a rule that a page really carries is sometimes absent from the grid, and why the rights of a page stop applying once it is moved to another wiki.
Where each level is stored
| Level | Page holding the objects | Class |
|---|---|---|
| The whole wiki | XWiki.XWikiPreferences | XWiki.XWikiGlobalRights |
| A page and its children | the WebPreferences page of that page | XWiki.XWikiGlobalRights |
| A page alone | the page itself, which is WebHome unless the page is terminal | XWiki.XWikiRights |
Only those combinations are read. An XWiki.XWikiRights object placed on a WebPreferences page applies to that configuration page alone, which no reader opens, and an "Admin" level inside an XWiki.XWikiRights object is ignored because "Admin" cannot be set on a single page, as Right Types lists.
Two of those three pages are [[hidden]], XWiki.XWikiPreferences and every WebPreferences page, so no link of the wiki leads to them and their objects cannot be reached by browsing. They are opened by asking for the object editor in their address: /bin/edit/XWiki/XWikiPreferences?editor=object for the wiki, and the path of a page followed by /WebPreferences?editor=object for that page and its children, as in /bin/edit/Sandbox/WebPreferences?editor=object. The objects of a page itself need no such address, since the "Edit" menu of that page offers an "Objects" entry.
Why the grid does not show every rule
The grid does not read directly from the stored rules. Instead, it builds itself from two things: the accounts that exist on the wiki, and the rights the administrator viewing it happens to have. Because of this, a rule can be active and enforced while the grid shows nothing about it:
- A column is displayed only for a right that the administrator holds themselves. An administrator without "Script" right sees no "Script" column, and the rules granting it stay out of reach.
- A row is displayed only for a user or a group that exists on the wiki. The grid lists the accounts and looks up their rules, never the other way round.
- On a subwiki the accounts of the main wiki are listed only once the scope is changed, as Set the Rights of a Wiki describes.
A rule pointing to an account that no longer exists
XWiki never checks whether the user or group named in a rule actually exists, and the rule still applies even if it doesn't. Such a rule matches nobody directly, but because allowing a right to someone implicitly denies it to everyone else at that level (see Rights Resolution), it can quietly lock everyone out. A page whose only rule grants "View" to a missing account ends up readable by no one, and its grid will show no rule at all, since there's no row to display it on.
This can't happen from a normal account deletion: XWiki automatically removes an account from every rights object, on every wiki, when that account is deleted. So if a rule points to a name that resolves to nothing, that account was never really an account of this wiki, but rather came from an import, a migration, or a typo.
References are relative to the wiki of the page
A rule stores the reference to a user or group as text. When that reference has no wiki prefix, for example just XWiki.Jane, (not xwiki:XWiki.Jane), XWiki reads it relative to the wiki the page is on, not the wiki the account is on. So if you move the page to another wiki, its rules now point to accounts on the new wiki, accounts that usually don't exist there. The rule doesn't disappear; it just stops matching anyone.
To fix this, you need to prefix the reference with the wiki that actually owns the account, for example, xwiki:XWiki.Jane for an account on the main wiki. That way the rule keeps working no matter where the page moves.
Note that these are two different situations. If you rename or move the user's or group's own account page, XWiki automatically updates every rule that referenced it, on every wiki. But if you move a page that simply contains a rights rule, leaving the account itself completely untouched, nothing gets updated automatically, and the references are left for you to fix by hand.
FAQ
Can I edit the rights objects directly?
Yes, with the object editor, and the result is exactly the same: the administration writes those same objects.
Why did setting a right create no new object?
The administration adds the right to an existing rule when one names that user or that group alone, and creates an object only when there is none.
Does copying a page copy its rights?
Yes, the objects are copied with the page and inside the same wiki the accounts they name still resolve.
Are the rules of a deleted user cleaned up?
Yes, deleting a user or a group removes it from the rights objects of every wiki of the farm.
