Perfuse v0.1.14

New

• Sign-on grants all six roles. OpenID Connect, SAML and LDAP group mappings can now grant monitor and operator as well as viewer, editor, admin and platform.
• Sign-on sets channel groups. A directory group can be limited to channel groups: a second box on its row in Administer → Sign-on, or channel_groups in the file. Once any group names one, every sign-in sets the person's channel groups from the groups that granted their role, so the strongest role is never joined to the widest reach. While no group names any, channel groups stay as an administrator set them.
• A different role in each channel group. Someone limited to channel groups can edit one and only view another: lab=editor, adt in Users. Every action is checked against the role in that channel's own group, and a refusal names the role the person holds there. Sign-in derives the same thing from directory groups. An account that sees every channel keeps one role. A facility's administrator grants roles only in the groups they administer, and never above their own role there.