Versions Compared
Key
- This line was added.
- This line was removed.
- Formatting was changed.
The data in the Voluntari.ly system must have integrity, security, privacy.
Access to the data through the service api must implement the following access rules
Access is controlled by the identity and Role of the user
User Roles
The data in the Voluntari.ly system must have integrity, security, privacy.
Access to the data through the service api must implement the following access rules
Access is controlled by the identity and Role of the user
User Roles
Role | Means |
---|---|
anon | person is not signed in. They can view various parts of the site but cannot change anything. Most clicks will prompt them to register and sign in. |
all | all signed in users, they can browse more of the site create opportunties and manage their personal profile. |
vp | volunteer time provider - i.e a volunteer, person who is interested in an opportunity. They can view opportunities in summary and detail form, show interest and communicate with the op-provider. by default everyone is a vp |
op | Opportunity provider - e.g a teacher. person who creates and manages an opportunity. |
ap | Activity provider / content provider, can create and manage activities. |
tester | can see debug and analytics pages |
admin | operational admin, can do almost everything through the UI |
org-admin | Can manage an organisation, its members and can set an approval process for listings |
owner | The specific person responsible for a record e.g a personal profile, opportuntity etc. |
Archived Opportunities
Role | Action | Permissions | Fields | Method + Route |
---|---|---|---|---|
anon | list | View all archived opportunities with status "Completed" | id, name, subtitle, img_url, duration | GET /api/archivedOpportunities |
anon | read | View individual archived opportunity records with status "Completed" | all | GET /api/archivedOpportunities/:id |
anon | create | No access | n/a | n/a |
anon | update | No access | n/a | n/a |
anon | delete | No access | n/a | n/a |
all | list | View all archived opportunities with status "Completed" | id, name, subtitle, img_url, duration | GET /api/archivedOpportunities |
all | read | View individual archived opportunity records with status "Completed" | all | GET /api/archivedOpportunities/:id |
all | create | No access | n/a | n/a |
all | update | No access | n/a | n/a |
all | delete | No access | n/a | n/a |
admin | list | View all archived opportunities | id, name, subtitle, img_url, duration | GET /api/archivedOpportunities |
admin | read | View individual archived opportunity records | all | GET /api/archivedOpportunities/:id |
admin | create | Can create records | all | POST /api/archivedOpportunities |
admin | update | Can update records | all | PUT /api/archivedOpportunities/:id |
admin | delete | Can delete records | all | DELETE /api/archivedOpportunities/:id |
Interests
Role | Action | Permissions | Fields | Method + Route | ||||
---|---|---|---|---|---|---|---|---|
anon | list | View all archived opportunities with status "Completed" | id, name, subtitle, img_url, durationNo access | n/a | GET /api/ | archivedOpportunitiesinterests | ||
anon | read | View individual archived opportunity records with status "Completed" | allNo access | n/a | GET /api/ | archivedOpportunitiesinterests/:id | ||
anon | create | No access | n/a | nPOST /api/ | ainterests | |||
anon | update | No access | n/a | n/aPUT /api/interests/:id | ||||
anon | delete | No access | n/a | n/a | all | list | View all archived opportunities with status "Completed" | id, name, subtitle, img_url, durationDELETE /api/interests/:id |
volunteer | list | Can list own interest records | All | GET /api/ | archivedOpportunitiesinterests | all|||
volunteer | read | View individual archived opportunity records with status "Completed" | allCan read own interest records | All | GET /api/ | archivedOpportunitiesinterests/:id | ||
volunteer | create | No access | n/a | n/a | allCan create own interest records | opportunity, comment (all other fields set by default) | POST /api/interests | |
volunteer | update | No access | n/a | n/a | allPUT /api/interests/:id | |||
volunteer | delete | No accessCan delete own interest records | n/a | n/a | adminDELETE /api/interests/:id | |||
op | list | View all archived opportunities | id, name, subtitle, img_url, durationCan list interest records for their opportunities | All | GET /api/archivedOpportunitiesinterests | |||
adminop | read | View individual archived opportunity records | allCan read interest records for their opportunities | All | GET /api/archivedOpportunitiesinterests/:id | |||
adminop | create | Can create records | allNo access | n/a | POST /api/archivedOpportunitiesinterests | |||
adminop | update | Can update status field of interest records for their opportunities | allstatus | PUT /api/archivedOpportunitiesinterests/:id | ||||
adminop | delete | Can delete records | allNo access | n/a | DELETE /api/archivedOpportunitiesinterests/:id |
org admin | |||||||||
Role | Action | Permissions | Fields | Method + Route | |||||
---|---|---|---|---|---|---|---|---|---|
anon | list | No access | n/a | list | Can list interest records for the opportunities provided by their organisation | All | GET /api/interests | anon||
org admin | read | No access | n/aCan read interest records for the opportunities provided by their organisation | All | GET /api/interests/:id | ||||
org admin | create | No access | n/a | POST /api/interests | anon|||||
org admin | update | No access | n/aCan update the status field of interest records for the opportunities provided by their organisation | status | PUT /api/interests/:id | ||||
anonorg admin | delete | No access | n/a | DELETE /api/interests/:id | |||||
volunteeradmin | list | Can list own all interest records Allon the platform | n/a | GET /api/interests | |||||
volunteeradmin | read | Can read own all interest records Allon the platform | n/a | GET /api/interests/:id | |||||
volunteeradmin | create | Can create own interest records | opportunity, comment (all other fields set by default)n/a | POST /api/interests | |||||
volunteeradmin | updateNo access | Can update all interest records on the platform | n/a | PUT /api/interests/:id | |||||
volunteeradmin | delete | Can delete own all interest records on the platform | n/a | DELETE /api/interests/:id | op | list | Can list interest records for their opportunities | Alla | DELETE /api/interests/:id |
Interest archive
Role | Action | Permissions | Fields | Method + Route | |||||
---|---|---|---|---|---|---|---|---|---|
anon | list | No access | n/a | GET /api/ | interestsinterestsArchived | op||||
anon | read | Can read interest records for their opportunities | AllNo access | n/a | GET /api/ | interestsinterestsArchived/:id | |||
anon | create | No access | n/a | POST /api/ | interestsInterestsArchived | op||||
anon | update | Can update status field of interest records for their opportunities | statusNo access | n/a | PUT /api/ | interestsinterestsArchived/:id | |||
anon | delete | No access | n/a | DELETE /api/ | interestsinterestsArchived/:id | org ||||
op | list | Can list interest archive records for | the their opportunities | provided by their organisationAlln/a | GET /api/ | interestsinterestsArchived | org admin|||
op | read | Can read interest archive records for | the their opportunities | provided by their organisationAlln/a | GET /api/ | interestsinterestsArchived/:id | |||
op | create | No access | n/a | POST /api/ | interestsInterestsArchived | org admin||||
op | update | Can update | the status field | of for interest archive records for | the their opportunities | provided by their organisationstatus | PUT /api/ | interestsinterestsArchived/:id | |
op | delete | No access | n/a | DELETE /api/ | interestsinterestsArchived/:id | ||||
org admin | list | Can list | all interest archive records | on the platformfor the opportunities provided by their organisation | n/a | GET /api/ | interestsinterestsArchived | ||
org admin | read | Can read | all interest archive records | on the platformfor the opportunities provided by their organisation | n/a | GET /api/ | interestsinterestsArchived/:id | ||
org admin | create | Can create interest recordsNo access | n/a | POST /api/ | interestsInterestsArchived | ||||
org admin | update | Can update | all status field for interest archive records | on the platformn/afor the opportunities provided by their organisation | status | PUT /api/ | interestsinterestsArchived/:id | ||
org admin | delete | Can delete all interest records on the platformNo access | n/a | DELETE /api/ | interests/:id
Interest archive
Role | Action | Permissions | Fields | Method + Route | |||
---|---|---|---|---|---|---|---|
anon | list | No accessinterestsArchived/:id | |||||
admin | list | Can list all interest archive records | n/a | GET /api/interestsArchived | |||
anonadmin | readNo access | Can read all interest archive records | n/a | GET /api/interestsArchived/:id | |||
anonadmin | createNo access | Can create interest archive records | n/a | POST /api/InterestsArchived | |||
anonadmin | updateNo access | Can update all interest archive records | n/a | PUT /api/interestsArchived/:id | |||
anonadmin | deleteNo access | Can delete all interest archive records | n/a | DELETE /api/interestsArchived/:id | op | list | Can list interest archive records for their opportunities:id |
Member
Role | Action | Permissions | Fields | Method + Route |
---|---|---|---|---|
anon | list | No access | n/a | GET /api/ |
members |
anon | read |
No access | n/a | GET /api/ |
members/:id |
anon | create | No access | n/a | POST /api/ |
members |
anon | update |
Can update status field for interest archive records for their opportunities
No access | n/a | PUT /api/ |
members/:id |
anon | delete | No access | n/a | DELETE /api/ |
members/:id |
all | list | Can list |
their own member records | n/a | GET /api/ |
members |
all | read | Can read |
their own member records | n/a | GET /api/ |
members/:id |
all | create |
No access
Can create their own member records with certain statuses | status (follower, joiner, validator), person (only themselves) | POST /api/ |
members |
all | update | Can |
update their own member records with certain statuses | status (none, follower, joiner, validator, exmember), person (only themselves) | PUT /api/ |
members/:id |
all | delete | No access | n/a | DELETE /api/ |
members/:id | ||
org admin | list | Can list |
member records for their organisations | n/a | GET /api/ |
members | ||
org admin | read | Can read |
member records for their organisations | n/a | GET /api/ |
members/:id | ||
org admin | create | Can create |
member records for their organisations | n/a | POST /api/ |
members | ||
org admin | update | Can update |
member records for their organisations | n/a | PUT /api/ |
members/:id | |
org admin | delete |
No access | n/a | DELETE /api/ |
members/:id |
admin | ||||||
Role | Action | Permissions | Fields | Method + Route | ||
---|---|---|---|---|---|---|
anon | list | No access | list | Can list all member records | n/a | GET /api/members |
anonadmin | readNo access | Can read all member records | n/a | GET /api/members/:id | ||
anonadmin | createNo access | Can create member records | n/a | POST /api/members | ||
anonadmin | updateNo access | Can update all member records | n/a | PUT /api/members/:id | ||
anonadmin | deleteNo access | Can delete all member records | n/a | DELETE /api/members/:idall |
People
Role | Action | Permissions | Fields | Method + Route |
---|---|---|---|---|
anon | list |
No access | n/a | GET /api/ |
people |
anon | read |
---|
No access | n/a | GET /api/ |
people/:id |
anon | create |
---|
Can create their own member records with certain statuses
No access | n/a | POST /api/ |
people |
anon | update |
---|
Can update their own member records with certain statuses
No access | n/a | PUT /api/ |
people/:id |
anon | delete | No access | n/a | DELETE /api/ |
---|
people/:id |
vp | list |
---|
Can list member records for their organisations
List all people 1 | See note 2 | GET /api/ |
org admin
read
Can read member records for their organisations
people | ||||
vp | read | Can read any person 1 Can be indirectly provided with contact details for a vp via an interested record in invited state | See note 2 | GET /api/ |
---|
people/:id |
vp | create |
---|
No access | n/a | POST /api/ |
people |
vp | update |
---|
No access | n/a | PUT /api/ |
people/:id |
vp | delete | No access | n/a | DELETE /api/ |
---|
people/:id |
op | list |
---|
Can list all member records
List all people 1 | See note 2 | GET /api/ |
people |
op | read | Can read |
---|
any person 1 | See note 2 | GET /api/ |
people/:id |
op | create |
---|
No access | n/a | POST /api/ |
people |
op | update |
---|
No access | n/a | PUT /api/ |
people/:id |
op | delete |
---|
No access | n/a | DELETE /api/ |
people/:id |
People
Role | Action | Permissions | Fields | Method + Route | ||
---|---|---|---|---|---|---|
tester | list | No access | n/aList all people 1 | See note 2 | GET /api/people | |
anontester | read | No access | n/aCan read any person 1 | All fields can be read | GET /api/people/:id | |
anontester | create | No access | n/a | POST /api/people | ||
anontester | updateNo access | Can update any person | n/a | PUT /api/people/:id | ||
anontester | deleteNo access | Can delete any person | n/a | DELETE /api/people/:id | ||
vporg admin | list | List all people 1 | See note 2 | GET /api/people | vp | read |
org admin | read | Can read any person 1 | See note 2 | GET /api/people/:id | ||
vporg admin | create | No access | n/a | POST /api/people | ||
vporg admin | update | No access | n/aCan update any person | Any field can be updated | PUT /api/people/:id | |
vporg admin | delete | No access | n/a | DELETE /api/people/:id | ||
admin | list | ListCan list all | people 1See note 2people | All fields | GET /api/people | |
opadmin | read | Can read any person 1See note 2person | All fields | GET /api/people/:id | ||
opadmin | create | No access | n/aCan create new user | All fields | POST /api/people | |
opadmin | update | No access | n/aCan update any person | All fields can be updated | PUT /api/people/:id | |
opadmin | deleteNo access | Can delete any person4 | n/a | DELETE /api/people/:id | ||
testerowner | list | List all people people 1 | See note 2 | GET /api/people | ||
testerowner | read | Can read any person 1All fields can be readperson | See note 2 and 3 | GET /api/people/:id | ||
testerowner | create | No access | n/a | POST /api/people | ||
testerowner | update | Can only update any person | n/a | PUT /api/people/:id | ||
tester | delete | Can delete any person | n/a | DELETE /api/people/:id | ||
org admin | list | List all people 1 | See note 2 | GET /api/people | ||
org admin | read | Can read any person 1 | See note 2 | GET /api/people/:id | ||
org admin | create | No access | n/a | POST /api/people | ||
org admin | update | Can update any person | Any field can be updated | their own record | Permitted to change:
Denied:
| PUT /api/people/:id |
org adminowner | deleteNo access | Can delete their own account4 | n/a | DELETE /api/people/:id | ||
admin | list | Can list all people | All fields | GET /api/people | ||
admin | read | Can read any person | All fields | GET /api/people/:id | ||
admin | create | Can create new user | All fields | POST /api/people | ||
admin | update | Can update any person | All fields can be updated | PUT /api/people/:id | ||
admin | delete | Can delete any person4 | n/a | DELETE /api/people/:id | ||
owner | list | List all people 1 | See note 2 | GET /api/people | ||
owner | read | Can read any person | See note 2 and 3 | GET /api/people/:id | ||
owner | create | No access | n/a | POST /api/people | ||
owner | update | Can only update their own record | Permitted to change:
Denied:
| PUT /api/people/:id | ||
owner | delete | Can delete their own account4 | n/a | DELETE /api/people/:id |
Notes:
- VP-1264 is the card to limit the people returned from the list API. VP-1267 is to limit who can access the read API
- Standard non-owner people fields are a whitelist of:
- id
- nickname
- language
- name
- status
- avatar
- about
- language
- imgUrl
- role
- pronoun
- tags
- website
- sendEmailNotifications
- VP-1268 is a card to return all fields when the request is for the current user
- VP-1297 future work to anonymise user's data but keep their person record so that relationships are preserved for historical data and analytics
## Create
Person - Created when new person signs in - All
Opportunity - all - but only into draft mode. May require org-admin approval to set active state
Activity - ap,
Organisation - Admin
Interest - vp
tag - all
## Read
Person - All
Opportunity - All+anon except in Draft mode - then only op-provider (op) and org-admin
Activity - All+anon except in Draft mode - then only activity-provider (ap) and org-admin
## Update
## Delete
In most cases Delete paths should be only available to Admin ( and some API keyholders)
Also in most cases Delete should not remove a document but move it into a new state, or collection.
Opportunities
List
GETNotes:
- VP-1264 is the card to limit the people returned from the list API. VP-1267 is to limit who can access the read API
- Standard non-owner people fields are a whitelist of:
- id
- nickname
- language
- name
- status
- avatar
- about
- language
- imgUrl
- role
- pronoun
- tags
- website
- sendEmailNotifications
- VP-1268 is a card to return all fields when the request is for the current user
- VP-1297 future work to anonymise user's data but keep their person record so that relationships are preserved for historical data and analytics
## Create
Person - Created when new person signs in - All
Opportunity - all - but only into draft mode. May require org-admin approval to set active state
Activity - ap,
Organisation - Admin
Interest - vp
tag - all
## Read
Person - All
Opportunity - All+anon except in Draft mode - then only op-provider (op) and org-admin
Activity - All+anon except in Draft mode - then only activity-provider (ap) and org-admin
## Update
## Delete
In most cases Delete paths should be only available to Admin ( and some API keyholders)
Also in most cases Delete should not remove a document but move it into a new state, or collection.
Opportunities
Role | Action | Permissions | Fields | Method + Route | Work done VP-1098? |
---|---|---|---|---|---|
anon | list | Can list opportunities Restrictions: active, near future, and returns Card level info (To see more they have to sign in) |
| GET /api/opportunities | ✔ |
anon | read | Can read any opportunity In general READ should have the same permissions as LIST |
| GET /api/opportunities/:id | ✔ |
anon | create | No access | n/a | POST /api/opportunities | ✔ |
anon | update | No access | n/a | PUT /api/opportunities/:id | ✔ |
anon | delete | No access | n/a | DELETE /api/opportunities/:id | ✔ |
vp | list | Can list published opportunities and see full details ( published includes active and completed) | All fields | GET /api/opportunities | ✔ |
vp | read | Can see full details of the published ops (active and completed) | All fields |
List
GET /api/opportunities
Role | Can |
---|---|
anon | can list ops with restrictions - (active, near future, and returns Card level info, no details). To see more they have to sign in. |
all | can list published ops and see full details ( published includes active and completed ) |
admin | can list ops in all states |
org-admin | can list published and draft ops created by people in their org |
Create
POST /api/opportunities
Role | Can |
---|---|
anon | cannot list people |
all | can list ops with restrictions - (active, near future, and returns Card level info, no details). To see more they have to sign in. |
all | can list published ops and see full details ( published includes active and completed ) |
admin | can list ops in all statespeople matching criteria and get limited info back. ( name, avatar and skills/interest ) but not contact details. |
vp | can create opportunities of the 'offer' type |
op | can create opportunities of the 'request' type into draft state but may require org-admin permission to move to active. org is fixed to org of owner |
admin | can create anything |
org-admin | can list published create ops and move draft ops created by people in their org |
Create
POSTto published. |
Read
GET /api/opportunities/:id
Role | Can |
---|---|
anon | cannot list people|
all | can list people matching criteria and get limited info back. ( name, avatar and skills/interest ) but not contact details. |
vp | can create opportunities of the 'offer' type |
op | can create opportunities of the 'request' type into draft state but may require org-admin permission to move to active. org is fixed to org of owner |
admin | can create anythingcan see full details of the op, (must be active state) need to sign in to express interest |
all | can see full details of the active and completed ops |
admin | can see full details of ops in all states |
org-admin | can create ops and move draft ops to published. |
Read
GETsee full details of ops in all states for ops created by people in their org. | |
owner | can see full details of ops they own |
---|
Update
PUT /api/opportunities/:id
Role | Can |
---|---|
anon | can see full details of the op, (must be active state) need to sign in to express interestno access |
all | can see full details of the active and completed opslist people matching criteria and get limited info back. ( name, avatar and skills/interest ) but not contact details. |
admin | can see full details of ops in all statesupdate ops including state change |
org-admin | can see full details of ops in all states update ops including state change for ops created by people in their org. |
owner | can see full details of ops they own |
Update
PUTupdate their own ops. cannot change org, |
Delete
DELETE /api/opportunities/:id
Role | Can |
---|---|
anon | no access |
all | can list people matching criteria and get limited info back. ( name, avatar and skills/interest ) but not contact details. |
admin | can update ops including state change |
org-admin | can update ops including state change for ops created by people in their org |
owner | can update their own ops. cannot change org, |
Delete
DELETE /api/opportunities/:id
Role | Can |
---|---|
anon | no access |
all | no access |
admin | can remove a record by putting it into archived collection |
org-admin | can remove a record by putting it into archived collection for their org |
owner | can change state to 'closed'no access |
admin | can remove a record by putting it into archived collection |
org-admin | can remove a record by putting it into archived collection for their org |
owner | can change state to 'closed' |
School invite
This API end point does not map to a mongoose model it is used to trigger invite school emails and by people who accept those school invites.
Role | Action | Permissions | Fields | Method + Route |
---|---|---|---|---|
all authenticated | n/a | Can visit URL to accept invite and will have their school created as an organisation and made an org admin of that school (URL will also include a token containing school id) | n/a | GET /api/notify/school-invite/accept |
admin | n/a | Can send a school invite email | n/a | POST /api/notify/school-invite |
Activities
List
GET /api/activities
Role | Can |
---|---|
anon | can list if active |
all | can list if active |
admin | can list all |
org-admin | can list all where ap is in org |
ap (owner) | can list all they are owner for |
Create
POST api/activity
Role | Can |
---|---|
anon | no access |
vp | no access |
op | no access |
ap | can create new activity record |
admin | can create new activity record |
org-admin | can act as ap for person in their org |
Read
GET api/activity/:id
Role | Can |
---|---|
anon | can view details if state is active |
all | can view details if state is active |
admin | can see all |
org-admin | can emulate ap for people in their org, can see draft acts. |
ap (owner) | can view details in all states. |
Update
PUT api/activity/:id
Role | Can |
---|---|
anon | no access |
all | no access |
vp | no access |
op | no access |
ap (owner) | can update acts they are owner for |
admin | can update |
org-admin | can act as ap for acts in their org |
Delete
DELETE api/activity/:id
Role | Can |
---|---|
anon | no access |
all | no access |
admin | can delete |
org-admin (owner org) | no access, can put into closed state (via Update) |
ap (owner) | no access, can put into closed state (via Update) |
Organisations
Organisation information is essentially public, everyone can read except for the info section which depends on membership status.
Note - in the medium term we do not need to block info fields from the API. We will communicate to orgAdmins that the content is not strictly private and should only contain summary information and links to internal web pages.
List
GET /api/organisations
Role | Can |
---|---|
anon | List all organisations, all fields |
vp | List all organisations, all fields |
op | List all organisations, all fields |
ap | List all organisations, all fields |
resource provider | List all organisations, all fields |
admin | List all organisations, all fields |
org-admin | List all organisations, all fields |
Read
GET /api/organisations/:id
Role | Can |
---|---|
anon | Read the entity and all fields |
vp | Read the entity and all fields |
op | Read the entity and all fields |
ap | Read the entity and all fields |
resource provider | Read the entity and all fields |
admin | Read the entity and all fields |
org-admin | Read the entity and all fields |
Create
POST /api/organisations
Role | Can |
---|---|
anon | No access |
vp | No access |
op | No access |
ap | No access |
resource provider | No access |
admin | Can create new organisation |
org-admin | No access |
Update
PUT /api/organisations/:id
Role | Can |
---|---|
anon | No access |
vp | No access |
op | No access |
ap | No access |
admin | Can update all fields |
org-admin |
|
Delete
Only system admins can delete an organisation. This should be a rare event as it will leave all the assets linked to the organisation dangling. i.e Ops.offerOrg, Member.organisation etc.
DELETE /api/organisations/:id
Role | Can |
---|---|
anon | No access |
vp | No access |
op | No access |
ap | No access |
admin | Can delete |
org-admin | No access |
Tags (TagList)
The tagList collection provides arrays of strings each of which is a word list that can be used for tags or select fields.
if requested without a wordlist id the GET call returns the default list of keywords.
As of Feb 2020 this feature is only partially implemented providing only a single word list.
The lists are read only to all except admins.
Role | Action | Permissions | Fields | Method + Route |
---|---|---|---|---|
anon | list | No access | n/a | GET /api/tags |
anon | read | No access | n/a | GET /api/tags/:id |
anon | create | No access | n/a | POST /api/tags |
anon | update | No access | n/a | PUT /api/tags/:id |
anon | delete | No access | n/a | DELETE /api/tags/:id |
Authed | list | List default word list | All | GET /api/tags |
Authed | read | List specific word list | All | GET /api/tags/:id |
Authed | create | No access | All | POST /api/tags |
Authed | update | No access | n/a | PUT /api/tags/:id |
Authed | delete | No access | n/a | DELETE /api/tags/:id |
admin | list | Can list all | All | GET /api/tags |
admin | read | Can read all | All | GET /api/tags/:id |
admin | create | Can create any | n/a | POST /api/tags |
admin | update | Can update any | n/a | PUT /api/tags/:id |
admin | delete | Can delete any | n/a | DELETE /api/tags/:id |
Table of Contents |
---|