Permissions

invoiceR almost always grants permissions through roles: a role receives permissions, and a user gets these permissions by becoming a member of the role.

Caution

Permissions can also be given directly to a user. We advise against this: the configuration quickly becomes confusing, and unwanted permissions creep in easily.

Editing a role’s permissions

1. Open Administration > Roles.
2. Edit the role and switch to the tab with the permissions.
3. Set or remove the ticks in the permission tree.
4. Save.

Permissions exist for these areas:

• pages and menu entries, for example task list, archive, master data and administration,
• actions in the task list,
• actions in the individual process steps, for example in accounting,
• administration functions such as editing the rules.

Restricting a permission to specific steps or organization units

For some permissions, a small icon appears next to the name in the tree. Clicking it opens a selection that lets you restrict the permission:

• to specific process steps: the permission then only applies in these steps, for example a button only in accounting but not in the final check.
• to specific organization units (tenants): the permission then only applies to documents of these organization units.

Permission tree of a role with the icon for restricting to organization units and the open selection

Who sees which tasks

Without special permissions, a user sees in the task list:

• all tasks assigned directly to them,
• all tasks of a role they are a member of,
• tasks where they are entered as deputy, while the actual owner is absent.

Two permissions extend this view:

Permission	Effect
Show all Users Tasks	A checkbox appears above the task list that lets the user display all tasks in invoiceR. Intended for administrators.
Show other Users Tasks	The checkbox Show other Users Tasks appears above the task list. The user then sees all tasks of the organization units they are authorized for.

Granting visibility of specific organization units

For “Show other Users Tasks” we recommend a separate role per group of people:

1. Create a role under Administration > Roles, for example Accounting tenant A.
2. In the permission tree, tick Show other Users Tasks.
3. Click the icon next to the permission and select the organization units whose tasks the role may see. Several organization units are possible.
4. Save the role and add the users concerned to the role.

Note

The assignment is stored in the conf.PermissionOrganizationUnits table. It used to have to be entered there by hand; today, maintain it through the role. invoiceR caches the assignments; if a change does not take effect immediately, log out and back in or clear the cache.