[rt-users] AdminClass right and RT-FM

[Tim Cutts]

On 27 Mar 2009, at 3:46 pm, Kevin Falcone wrote:

>
> On Mar 27, 2009, at 11:20 AM, Tim Cutts wrote:
>
>> I'm in the process of deploying RT-FM, and I have come across a
>> strangeness with access to classes in order to configure them.  We
>> have an rt-admin group, to which I have given the AdminClass right
>> globally.
>>
>> However, when I go to the configure page for the classes, I (a member
>> of the rt-admin group) can only see one of the two classes that I  
>> have
>> created, and I don't understand why.
>
> There is also a SeeClass right you might want to grant.

Yep, done that (AdminClass is the crucial one, judging by RT-FM/html/ 
Admin/RTFM/Classes/index.html)

>> I tried to create a small perl script to examine the rights directly:
>>
>> #!/usr/bin/perl -w
>>
>> use strict;
>>
>> use lib qw'/opt/rt3/lib /opt/rt3/local/lib';
>>
>> use RT;
>> use RT::Interface::CLI qw/GetCurrentUser/;
>>
>> RT::LoadConfig;
>> RT::Init;
>>
>> my $user = GetCurrentUser();
>>
>> my $c = RT::FM::Class->new($user);
>>
>> $c->Load('someclassname');
>>
>> if ($user->HasRight(Right => 'AdminClass',
>> 		    Object => $c)) {
>>  print "Yes we can\n";
>> }
>>
>>
>> but I'm not sure I've done this right, because it dies with:
>>
>> Can't locate object method "new" via package "RT::FM::Class" (perhaps
>> you forgot to load "RT::FM::Class"?) at test.pl line 15, <DATA> line
>> 273.
>
> you need to use RT::FM::Class; before you call new on it

Actually, it seems to be require that's needed but not use.  Thanks  
for the hint.

It's a bit inconsistent with searching for RT core objects.
If it were a ticket I was looking for, I wouldn't need to "require  
RT::Ticket":

Anyway, that aside, my script now works, and it shows that my user  
indeed does not seem to have rights to access that class, but I don't  
understand why, given that the user *is* a member of the rt-admin  
group, and the rt-admin group *does* have that right.

Workaround:  If I configure the right at the per-Class level, it works  
fine.  It seems that it's only the global right that doesn't seem to  
work.  Should I file a bug report?

Tim


-- 
 The Wellcome Trust Sanger Institute is operated by Genome Research 
 Limited, a charity registered in England with number 1021457 and a 
 company registered in England with number 2742969, whose registered 
 office is 215 Euston Road, London, NW1 2BE.