Roles and access

Rights in the app come from roles at four levels. A system administrator can see and change everything: every organisation, user and course, and other admins’ roles too. Rights are checked on the server every time; a hidden button is never the protection.

Roles

Level	Roles	Granted by
System	System admin	Other system admins
Organisation	Admin, Teacher, Member	System and organisation admins
Group	Teacher (group admin), Member	Organisation admins
Course	Owner, Teacher, Assistant, Student	Course owners and organisation admins

• An organisation teacher can create courses and use the problem library in the organisation without administering it. Becoming a group’s teacher gives this role automatically, and someone whose organisation admin role is removed stays a teacher.
• A group teacher sees only their groups’ students and can add the group to their courses.
• Students reach a course through a group or by direct enrolment. They see only their own progress and submissions, plus their group’s reduced progress sheet while the course shows it.

Organisation administrators’ daily work is described in the section for staff.

What only system admins can do

Action	System admin	Organisation admin
Administration	Every part	Their own organisation only; no System roles or Statistics
Granting and revoking system admin	Yes	No
Creating, renaming, archiving organisations; Needs attention	Yes	No (they see their own organisation read-only)
Making someone an organisation admin	Any active account (it joins the organisation)	Members of their own organisation only
Removing an organisation’s last admin	Yes	No
Users list	Every account, including those without an organisation	Members of their organisations
Disabling an account	Anyone except themselves and system admins	Only members who belong to their organisations alone; not other organisation admins
Temporary password	Anyone except themselves and system admins	Organisation members, except other organisation admins
Impersonating a user	Any active account except their own and system admins’	No
Courses	Every organisation’s, with an organisation filter; manages any course as its owner	Their organisations’ courses
Problem library	Sees and edits everything, including imported problems with no owner; changes a problem’s owner	Public and organisation items
Skill vocabulary (Administration → Skills)	Keeps it (see Skill vocabulary)	No; uses the skills on their problems
Wiki	Edits any page, changes its owner and readers	Edits the organisation’s pages

Granting system admin

1. Open Administration → System roles.
2. Click Grant system admin.
3. Search for an active account by name or username and click Choose.
4. Confirm: Make system admin.

The role can be given only to an active account. The new admin immediately sees the whole platform and can change other admins’ roles too. Grant it only to those who really need it.

Screenshot to comeThe System roles page with the list of system admins and the Grant system admin buttonSystem admin account, Administration → System roles, two invented admins in the listadmins/administration/system-roles

Revoking the role

1. In the System roles list, open the row’s menu and choose Revoke role….
2. Confirm: Revoke role.

• The last active system admin can’t be revoked.
• The account and its other roles stay; only platform-wide access goes.
• If you revoke your own role, you lose access to system administration immediately.
• A system admin’s account can’t be disabled: revoke the role first.

Open pages pick up the change within about a second.

Accounts across the system

For a system admin, Administration → Users lists every account on the platform. In the Organisation filter, choose No organisation to find accounts that organisation admins can’t see. Export CSV downloads the list, which contains personal data.

Open a user to:

• Edit name…: correct the given and family name;
• Reset password…: the account is signed out everywhere and a new temporary password is shown once. It must be changed at the next sign-in. This also lifts the username’s lock after too many failed attempts;
• Disable account… / Enable account…: a disabled account is signed out everywhere and can’t sign in; submissions and marks stay;
• Add to organisation…, Make teacher…, Add to group…, Move to group…;
• Impersonate: use the app as this user (see Impersonating a user).

Besides admins, teachers also set temporary passwords: course owners and teachers for their courses’ students, group teachers for their groups’ members. They can never set one for another staff member.

Impersonating a user

To see the app exactly as someone sees it, for example to help with a problem they report, open them in Administration → Users, click Impersonate and confirm: Impersonate.

• The app reloads as that user: their courses, results, messages and settings. An orange bar across the top names them, an orange frame goes around the window, and the user card says Impersonating.
• Everything you do counts as theirs: a submitted solution, a sent message, a notification marked as read. Do only what you came to do.
• You have their rights, not yours, so Administration isn’t there. Their password, signed-in devices, linked accounts and connected apps stay out of reach, and settings you change aren’t saved to their account. Live updates keep working; product analytics is off.
• It ends after an hour, or when you click Return to my account in the bar or the user menu. You come back to the user’s panel in Administration → Users.
• It applies to your sign-in in this browser: other open tabs of the app switch to the user too when they next load a page.
• System administrators and disabled accounts can’t be impersonated.
• The start and the end are recorded in the user’s Recent changes.

Wiki page owner and readers

Only system admins can change who reads a page and who owns it.

1. Open the page in the Wiki. The page settings show on the right.
2. Readers: choose Public (everyone who signs in) or an organisation (its members, students included).
3. Owner: click Change owner and pick an active staff member in Find a teacher.

• A page and its subpages always have the same readers. If the page has subpages, move them elsewhere first.
• Changing a subpage’s readers moves it to the top level.

Problem owner

Only system admins can hand problems to another owner, for example the problems imported from the old system to the teacher who will look after them. Nobody else can, not even the current owner or an organisation admin.

1. In the Problem archive, open the problem and, in the Sharing card, click Change owner… next to Owner. For several problems at once, tick them in the list and choose Change owner… in the selection bar.
2. Search for the new owner by name or username and click Continue. Only people who can own problems are offered: active organisation admins and teachers, group and course teachers, and system admins (not students or assistants).
3. Read what changes and confirm: Change owner.

• The new owner can edit, publish, share, archive and delete the problems straight away. Previous owners lose their owner rights; organisation admins and collection editors keep theirs.
• Nothing else changes: sharing, the organisation, collections, the courses that use the problems, and version history (each version still records who wrote it).
• The change is recorded in the new owner’s Recent changes, one entry per previous owner with the number of problems.

Audit trail

Sensitive changes are recorded in the audit trail in the same transaction as the change itself: account creation, temporary passwords, disabling and enabling accounts, name corrections, system, organisation and group roles, group and organisation membership, linking Google or GitHub accounts, problem owner changes, and impersonation.

• The entries show in the user panel under Recent changes, with the action, who did it and when. There’s no separate audit page.
• Entries hold no passwords or names: just the action, who did it and counts.
• Manual SQL changes aren’t recorded.

“Act as”

“Act as” lets you browse as another user without signing in, but it’s a development tool only: it works only while NODE_ENV isn’t production and DEV_ACT_AS=1. It doesn’t exist in a production build and can’t be turned on there. In production, use Impersonate.