Roles and privileges#
A role decides what someone may do in the system. It is the single place where access is controlled — both to the administration and to content on the site.
Find it under Základy → Uživatelé → Role a privilégia, which holds three screens:
| Screen | What it contains |
|---|---|
| Role | the roles themselves — who someone can be |
| Privilégia | the individual rights roles are built from |
| Skupiny privilegií | privileges bundled into groups for clarity |
How it fits together#
A user holds one or more roles. A role carries a set of privileges. When a user attempts something, the system looks for a role of theirs that allows it.
If none does, the action does not happen — in the administration the item is not even shown in the menu.
Predefined roles#
| Role | Code | Purpose |
|---|---|---|
| Guest | guest |
a signed-out visitor |
| Registered | registrated |
an ordinary signed-in user |
| Administrator | admin |
system administration |
| Owner | owner |
the owner of a particular record |
Role flags#
Each role in the list carries five toggles. Their meaning is not self-evident:
Po registraci (after registration) — the role is assigned automatically to everyone who registers. Registered has it.
Přiřaditelná (assignable) — the role is offered in the user form. A role without this flag cannot be assigned by hand.
Implicitní (implicit) — the tie to sign-in state: anonymous (signed out),
authenticated (signed in), none (no tie; the role is assigned manually only).
Podmíněná (conditional) — the role is not assigned; it is derived at runtime from context. Typically Owner: you are not an owner in general, you are the owner of that one record you created. That is why such a role is not assignable — you deliberately will not find it in the user form.
Plný rozsah (full scope) — a role whose holder also sees the protected fields of records. By default only Administrator has it.
It does NOT mean "passes everywhere" — privileges are still required
This is the most common misunderstanding about roles. The flag does not replace privileges: the system first asks whether the action belongs to the role at all, and only for actions that do belong to it does the flag decide how much data it sees. A role with full scope and no privileges can do nothing.
What it does switch on is access to otherwise hidden data
This flag is exactly what unlocks fields such as payment gateway credentials or password hashes. Handing it to temporary staff because "they keep missing something" exposes those too — and does not fix the missing right anyway. If a role lacks access, give it a privilege, not full scope.
Creating your own role#
- přidat in the role list.
- Name and code. The code is technical: no diacritics, no spaces.
- Turn on Přiřaditelná so the role can be picked on a user.
- Leave Po registraci off unless every new user should get it.
- Leave Podmíněná and Plný rozsah off.
- Save, then assign privileges.
Suggested setups#
Editor — writes content, does not touch money: pages, articles, news, galleries. No e-shop, invoicing, payments, users or settings.
E-shop manager — processes orders: orders, products, prices, stock, complaints. No users, roles or system settings.
Bookkeeper — documents: all of invoicing, read access to orders. No content, no settings.
Add rather than remove
Create a role with the bare minimum and add whatever people report they cannot do. The opposite approach — grant everything then take away — leaves doors open in places nobody thinks of.
Verifying what a role can actually do#
Configuration is not the same as reality. Before handing a role over:
- Create a test account and assign the role to it.
- Sign in as that account in a different browser (or a private window) — otherwise you lose your own session.
- Walk through what appears in the menu.
- Try opening an address the role must not reach. It must not go through.
A hidden menu is not a prohibition
An item missing from the menu does not mean the address cannot be reached. Verify by clicking through, not by looking at the menu.
Why a colleague sees something different#
Most often:
- they hold a different role,
- they hold several roles and the rights add up,
- their role holds a privilege you overlooked,
- your site does not have that module enabled (then nobody sees it).