security-privileges

To add new user privileges for HMIS, declare them in the Privileges.java enum file by appending new values without reordering existing ones. Assign the new privileges through the User Privileges administration UI rather than seeding them directly in the database.

Enforce role-based access control in HMIS controllers by calling webUserController.hasPrivilege(...) with the required Privileges.java enum value to verify user authorization before processing requests or rendering XHTML views.

Assign HMIS privileges to user roles exclusively through the User Privileges administration interface. Never seed privileges directly in the database, as the UI manages the mapping between roles and the Privileges.java enum declarations securely.

Yes, you can check HMIS user privileges for conditional XHTML rendering by using the webUserController.hasPrivilege(...) method. Name privileges descriptively in the enum so their usage remains obvious during access control checks in views.

Avoid reordering existing entries in the Privileges.java enum because enum ordinals are persisted and used for database references. Reordering breaks existing role-based access control mappings and corrupts the HMIS security controls across modules.

Audit HMIS security controls by reviewing Privileges.java enum declarations, verifying webUserController.hasPrivilege(...) checks in controllers, and inspecting role assignments via the User Privileges administration interface across all modules.