Skip to content

Group roles

A group role applies to one specific membership in one specific group. The same user can be a Manager in org A and an Attendee in event B — these are independent.

For the user-facing description of what each role does, see Members and roles in the Concepts section. This page is the administrator's view — how the roles are defined, how they are assigned, and how to change them.

The three role categories

Every group role belongs to one of three categories:

Category How assigned Examples
Outsider Automatically, from the user's site role. anonymous, outsider, devops_out, admin_out
Insider Automatically, from the site role, once the user is added to the group. member, devops_in, admin_in
Individual Manually, per membership. manager, host, speaker, moderator, attendee, service, observer

The auto-sync is governed by the scope and global_role keys in fedms_federation/config/roles_permissions.yml.

The three group bundles

Group roles are defined per group bundle — org, event, or session. The set of available roles is similar across bundles, with some bundle-specific differences.

Org roles

Defined under _groups.org in roles_permissions.yml. The individual roles available on an org are:

  • Manager
  • Host / Sponsor
  • (Org-level Member, Outsider, Anonymous, DevOps, Administrator are sync-driven.)

Note: roles like Speaker, Moderator, Attendee, Service Provider, Observer are not assignable at the org level. They only make sense at the event/session level.

Event roles

Defined under _groups.event. The individual roles are:

  • Manager
  • Host / Sponsor
  • Speaker / Tutor
  • Moderator
  • Attendee / Delegate
  • Service Provider
  • Observer

Session roles

Defined under _groups.session. The same individual roles as for events.

Editing the role configuration

To change role permissions:

  1. Edit fedms_federation/config/roles_permissions.yml.
  2. Find the group bundle and the role.
  3. Add or remove permission strings.
  4. Commit, deploy, rebuild on each instance:
1
l3d drush roles-permission-builder:rebuild

Adding a custom role

Roles can be added per bundle. For example, to add an "Apprentice" role on sessions:

1
2
3
4
5
6
7
8
9
_groups:
  session:
    apprentice:
      label: 'Apprentice'
      weight: -7
      permissions:
        - 'view group'
        - 'view fedms_session:in entity'
        - 'view group_media:document entity'

After the next rebuild, the new role appears in the membership form on session groups, and on the user profile's memberships page.

Group role weights

The weight controls the display order in role pickers (and, by convention, the "seniority" — higher = more important). Built-in weights run from -10 (Anonymous) to +3 (Administrator).

Group role pairing with global roles

The global_role key on a group role wires it to a site role. This is what implements the outsider/insider sync described in Site roles.

ECA-driven side effects

Some role changes trigger ECA-model behavior:

  • Adding a member to a group fires content_entity:insert on group_relationship, which the task_api ECA model listens to.
  • Adding / removing / re-activating members fires the lifecycle events handled by group_members.

If you change group roles, audit those ECA models to make sure the behavior you want is still triggered.

Next steps