Package ca.cdr.api.model.enm

Enum Class PermissionEnum

java.lang.Object

java.lang.Enum<PermissionEnum>

ca.cdr.api.model.enm.PermissionEnum

All Implemented Interfaces:

Serializable, Comparable<PermissionEnum>, Constable

public enum PermissionEnum
extends Enum<PermissionEnum>

Nested Class Summary

Nested classes/interfaces inherited from class java.lang.Enum

Enum.EnumDesc<E extends Enum<E>>

Enum Constant Summary

Enum Constants

Enum Constant	Description
ACCESS_ADMIN_JSON	User is allowed to use the JSON Admin API services
ACCESS_ADMIN_WEB	User is allowed to log into the web admin console
ACCESS_EASYSHARE	User can log in to EasyShare
ACCESS_FHIR_ENDPOINT	User is allowed to access FHIR services
ACCESS_FHIRWEB	User has permission to log into the FHIRWeb console
AG_ADMIN_CONSOLE_READ	User can perform read operations from the appSphere Admin Console
AG_ADMIN_CONSOLE_WRITE	User can perform write operations from the appSphere Admin Console
AG_DEV_PORTAL_READ	User can perform read operations from the appSphere Developer Portal
AG_DEV_PORTAL_WRITE	User can perform write operations from the appSphere Developer Portal
ARCHIVE_MODULE	User can archive module
BATCH_JOB_ANALYTICS	Permission for job-analytics operation
BLOCK_FHIR_READ_UNLESS_CODE_IN_VS	User is allowed to access resources with a code
BLOCK_FHIR_READ_UNLESS_CODE_NOT_IN_VS	User is allowed to access resources with a code
CDA_IMPORT	User can perform a CDA Import operation
CHANGE_OWN_DEFAULT_LAUNCH_CONTEXTS	User can update their own launch contexts
CHANGE_OWN_PASSWORD	User has permission to change password
CHANGE_OWN_TFA_KEY	User can change their own TFA key
CONTROL_MODULE	User can start/stop/restart modules
CONTROL_MODULE_FOR_MODULE	User can start/stop/restart a specific module id for a node id
CREATE_CDA_TEMPLATE	User is allowed to create new CDA Document Templates
CREATE_MODULE	User is allowed to create new modules
CREATE_USER	User can create other users
DELETE_CDA_TEMPLATE	User is allowed to delete CDA Document Templates
DOCREF	User can perform a docref operation
DQM_QPP_BUILD	Permission for qpp-build operation.
EASYSHARE_CREATE_SMART_HEALTH_LINK	User can create a SMART Health Link using EasyShare
EMPI_ADMIN	Legacy permission for backward compatibility.
EMPI_UPDATE_MATCH_RULES	Legacy permission for backward compatibility.
EMPI_VIEW_MATCH_RULES	Legacy permission for backward compatibility.
ETL_IMPORT_PROCESS_FILE	User is allowed to initiate processing an ETL job
FHIR_ACCESS_PARTITION_ALL	User is allowed to access (includes both read and write operations) data in all partitions.
FHIR_ACCESS_PARTITION_NAME	User is allowed to access (includes both read and write operations) data in the given partition.
FHIR_ALL_DELETE	User is allowed to perform any FHIR delete operation
FHIR_ALL_READ	User is allowed to perform any FHIR read/access-to-data operation, e.g.
FHIR_ALL_WRITE	User is allowed to perform any FHIR write/modify operation, e.g.
FHIR_AUTO_MDM	User will have MDM expansion performed automatically on all queries
FHIR_BATCH	User is allowed to perform FHIR transactions
FHIR_CAPABILITIES	User is allowed to access the server capability statement
FHIR_DELETE_ALL_IN_COMPARTMENT	User is allowed to perform any FHIR delete operation on a given compartment
FHIR_DELETE_ALL_OF_TYPE	User is allowed to perform any FHIR delete operation on the given type
FHIR_DELETE_CASCADE_ALLOWED	Any delete permissions granted to the user may be applied to cascaded deletes as well as normal deletes.
FHIR_DELETE_EXPUNGE	User is permitted to invoke the $delete-expunge operation
FHIR_DELETE_TYPE_IN_COMPARTMENT	User is allowed to perform any FHIR delete operation on a given compartment
FHIR_DTR_USER	User may perform all DTR operations
FHIR_EMPI_ADMIN	Legacy permission for backward compatibility.
FHIR_EXPUNGE_DELETED	User is permitted to invoke the $expunge operation with expungeDeletedResources=true
FHIR_EXPUNGE_EVERYTHING	User is permitted to invoke the $expunge operation with expungeEverything=true
FHIR_EXPUNGE_PREVIOUS_VERSIONS	User is permitted to invoke the $expunge operation with expungePreviousVersions=true
FHIR_EXTENDED_OPERATION_ON_ANY_INSTANCE	User may invoke operation at the instance level for any type with name specified by argument (e.g.
FHIR_EXTENDED_OPERATION_ON_ANY_INSTANCE_OF_TYPE	User may invoke operation at the instance level with type and name specified by argument (e.g.
FHIR_EXTENDED_OPERATION_ON_SERVER	User may invoke operation with name specified by argument (e.g.
FHIR_EXTENDED_OPERATION_ON_TYPE	User may invoke operation at the type level with type and name specified by argument (e.g.
FHIR_EXTENDED_OPERATION_SUPERUSER	User may invoke any kind of operation
FHIR_GET_RESOURCE_COUNTS	User is permitted to call the $get-resource-counts operation
FHIR_GRAPHQL	User is allowed to perform FHIR GraphQL Operations
FHIR_LIVEBUNDLE	User is permitted to invoke the $livebundle-watchlist-add, $livebundle-watchlist-delete, $livebundle-watchlist, and $livebundle operations
FHIR_MANAGE_PARTITIONS	User is permitted to invoke the operations $partition-management-create-partition, $partition-management-read-partition, $partition-management-update-partition, $partition-management-delete-partition, $partition-management-list-partitions,
FHIR_MANUAL_VALIDATION	User is allowed to invoke the `$validate` operation to validate resources
FHIR_MDM_ADMIN	User may perform all MDM operations
FHIR_META_OPERATIONS_SUPERUSER	User is permitted to invoke the $meta, $meta-add, and $meta-delete operations on any resource.
FHIR_MODIFY_SEARCH_PARAMETERS	User is allowed to create, update, and delete search parameters
FHIR_OP_APPLY	User is permitted to call the $apply operation
FHIR_OP_BINARY_ACCESS_READ	User is allowed to invoke the $binary-access-XXX operation (note that the user will also need permission to read/write the individual resource that is actually being accessed)
FHIR_OP_BINARY_ACCESS_WRITE	User is allowed to invoke the $binary-access-XXX operation (note that the user will also need permission to read/write the individual resource that is actually being accessed)
FHIR_OP_CARE_GAPS	Permission for care-gaps operation.
FHIR_OP_COLLECTDATA	Permission for $collect-data operation.
FHIR_OP_CQL	Permission for cql operation.
FHIR_OP_DATAREQUIREMENTS	Permission for $data-requirements operation.
FHIR_OP_EMPI_CLEAR	Legacy permission for backward compatibility.
FHIR_OP_EMPI_DUPLICATE_PERSONS	Legacy permission for backward compatibility.
FHIR_OP_EMPI_MERGE_PERSONS	Legacy permission for backward compatibility.
FHIR_OP_EMPI_QUERY_LINKS	Legacy permission for backward compatibility.
FHIR_OP_EMPI_SUBMIT	Legacy permission for backward compatibility.
FHIR_OP_EMPI_UPDATE_LINK	Legacy permission for backward compatibility.
FHIR_OP_ENCOUNTER_EVERYTHING	User is allowed to perform the encounter $everything operation
FHIR_OP_EVALUATE	Permission for evaluate operation.
FHIR_OP_EVALUATE_MEASURE	CQL Permission for evaluate-measure operation.
FHIR_OP_EVALUATE_MEASURES	Permission for evaluate-measures operation.
FHIR_OP_EXTRACT	User is permitted to call the $extract operation
FHIR_OP_INITIATE_BULK_DATA_EXPORT	User is allowed to initiate a bulk data export using the $export operation
FHIR_OP_INITIATE_BULK_DATA_EXPORT_ALL_PATIENTS	Bulk Export for all patients
FHIR_OP_INITIATE_BULK_DATA_EXPORT_GROUP	Bulk export - group Level
FHIR_OP_INITIATE_BULK_DATA_EXPORT_PATIENT	Deprecated. In favour of FHIR_OP_INITIATE_BULK_DATA_EXPORT_PATIENTS and FHIR_OP_INITIATE_BULK_DATA_EXPORT_ALL_PATIENTS
FHIR_OP_INITIATE_BULK_DATA_EXPORT_PATIENTS	Bulk Export for a list of patient IDs and resource types
FHIR_OP_INITIATE_BULK_DATA_EXPORT_SYSTEM	Bulk export - System Level
FHIR_OP_INITIATE_BULK_DATA_IMPORT	User is allowed to initiate a bulk data import using the $import operation
FHIR_OP_MDM_CLEAR	User may invoke the MDM $mdm-clear Operation
FHIR_OP_MDM_CREATE_LINK	User may invoke the MDM $mdm-create-link operation on a Golden Resource
FHIR_OP_MDM_DUPLICATE_GOLDEN_RESOURCES	User may invoke the MDM $mdm-duplicate-golden-resources
FHIR_OP_MDM_LINK_HISTORY	User may invoke the MDM $mdm-query-links operation
FHIR_OP_MDM_MERGE_GOLDEN_RESOURCES	User may invoke the MDM $mdm-merge-golden-resources operation on Golden Resources
FHIR_OP_MDM_NOT_DUPLICATE	User may invoke the MDM $mdm-not-duplicate
FHIR_OP_MDM_QUERY_LINKS	User may invoke the MDM $mdm-query-links operation
FHIR_OP_MDM_SUBMIT	User may invoke the MDM $mdm-submit operation
FHIR_OP_MDM_UPDATE_LINK	User may invoke the MDM $mdm-update-link operation on a Golden Resource
FHIR_OP_MEMBER_MATCH	User is allowed to perform the $member-match operation
FHIR_OP_PACKAGE	User is permitted to call the $package operation
FHIR_OP_PATIENT_EVERYTHING	User is allowed to perform the patient $everything operation
FHIR_OP_PATIENT_EVERYTHING_ACCESS_ALL	User is allowed to perform the patient $everything operation with `Access All` permission
FHIR_OP_PATIENT_MATCH	User may invoke the MDM $match operation on a Patient
FHIR_OP_PATIENT_SUMMARY	User is allowed to perform the patient $summary operation
FHIR_OP_POPULATE	User is permitted to call the $populate operation
FHIR_OP_PREPOPULATE	User is permitted to call the $prepopulate operation
FHIR_OP_STRUCTUREDEFINITION_SNAPSHOT	User is allowed to perform the $snapshot operation
FHIR_OP_SUBMIT_DATA	Permission for submit-data operation.
FHIR_PATCH	Deprecated. FHIR_PATCH will be removed: Users should instead be granted more granular write permissions that cover PATCH operations.
FHIR_PROCESS_MESSAGE	User is allowed to invoke the `$process-message` operation to accept a message
FHIR_READ_ALL_IN_COMPARTMENT	User is allowed to read any resources in the given compartment
FHIR_READ_ALL_OF_TYPE	User is allowed to read any resources of the given type
FHIR_READ_INSTANCE	User is allowed to read a specific resource instance by ID
FHIR_READ_SEARCH_PARAMETERS	User is allowed to read search parameters
FHIR_READ_TYPE_IN_COMPARTMENT	User is allowed to read any resources of the given type in the given compartment
FHIR_TRANSACTION	User is allowed to perform FHIR transactions
FHIR_TRIGGER_SUBSCRIPTION	User is allowed to invoke the $trigger-subscription operation
FHIR_UPDATE_REWRITE_HISTORY	User can perform an update on the historical version of a resource
FHIR_UPLOAD_EXTERNAL_TERMINOLOGY	User is permitted to upload external code systems
FHIR_WRITE_ALL_IN_COMPARTMENT	User is allowed to write any resources in the given compartment
FHIR_WRITE_ALL_OF_TYPE	User is allowed to write any resources of the given type
FHIR_WRITE_INSTANCE	User is allowed to write a specific resource instance by ID
FHIR_WRITE_TYPE_IN_COMPARTMENT	User is allowed to write any resources of the given type in the given compartment
HFQL_EXECUTE	User is allowed to execute HFQL queries
INVOKE_CDS_HOOKS	User can call CDS Hooks
MANAGE_BATCH_JOBS	User has permission to manage (modify) batch jobs
MDM_ADMIN	User can perform any MDM operations
MDM_UPDATE_MATCH_RULES	User can set/update MDM match rules
MDM_VIEW_MATCH_RULES	User can see MDM match rules
MODULE_ADMIN	User is allowed to create, reconfigure and start/stop modules
MODULE_ADMIN_FOR_MODULE	User is allowed to reconfigure and start/stop a specific module id for a node id
OIDC_CLIENT_PRESET_PERMISSION	User is allowed to create OpenID Connect clients with pre-set permissions
OPENID_CONNECT_ADD_CLIENT	User is allowed to create OpenID Connect clients
OPENID_CONNECT_ADD_SERVER	User is allowed to add OpenID Connect servers
OPENID_CONNECT_EDIT_CLIENT	User is allowed to edit existing OpenID Connect clients
OPENID_CONNECT_EDIT_SERVER	User is allowed to edit OpenID Connect servers
OPENID_CONNECT_MANAGE_GLOBAL_SESSIONS	User is allows to manage other users' OIDC sessions (view active sessions and revoke them).
OPENID_CONNECT_MANAGE_KEYSTORES	User is allowed to manage (view/create/update/delete) OIDC Keystore definitions
OPENID_CONNECT_VIEW_CLIENT_LIST	User is allowed to view existing OpenID Connect client list
OPENID_CONNECT_VIEW_SERVER_LIST	User is allowed to view existing OpenID Connect server list
PACKAGE_REGISTRY_READ	User can perform read operations from the package registry
PACKAGE_REGISTRY_WRITE	User can perform read operations from the package registry
REINSTATE_MODULE	User can reinstate module
ROLE_ANONYMOUS	User is not logged in or has not supplied credentials
ROLE_FHIR_CLIENT	User is allowed to use a FHIR client
ROLE_FHIR_CLIENT_SUPERUSER	User has permission to perform any standard FHIR client operation (does not imply superuser status for other parts of the CDR, e.g.
ROLE_FHIR_CLIENT_SUPERUSER_RO	Any read functions
ROLE_FHIR_TERMINOLOGY_READ_CLIENT	User is permitted to call read-only terminology methods, such as $lookup, $validate-code
ROLE_MDMUI_ADMIN_FHIR
ROLE_MDMUI_DATASTEWARD_FHIR
ROLE_SUPERUSER	User has all permissions to do anything Implied permissions are populated internally and not explicitly defined in the constructor.
ROLE_SYSTEM	Actions performed by the system itself.
ROLE_SYSTEM_INITIALIZATION	Actions performed by the system itself during initialization
SAVE_USER	User can view, create, and update users
START_STOP_MODULE	User is allowed to start/stop modules
START_STOP_MODULE_FOR_MODULE	User is allowed to start/stop a specific module id for a node id
SUBMIT_ATTACHMENT
UPDATE_MODULE_CONFIG	User is allows to modify a module's configuration
UPDATE_MODULE_CONFIG_FOR_MODULE	User is allowed to modify a specific module id's configuration for a node id
UPDATE_USER	User can update existing users other than themself
USE_CDA_TEMPLATE	User is allowed to use CDA Document Templates, potentially persisting a Composition, Bundle, and returning sensitive information in the resultant XML
VIEW_AUDIT_LOG	User is allowed to view the audit log
VIEW_BATCH_JOBS	User has permission to view batch jobs
VIEW_CDA_TEMPLATE	User is allowed to view CDA Document Templates
VIEW_METRICS	User can access internal metrics API, including thread dump API
VIEW_MODULE_CONFIG	User can see (but not change) module configuration information (not including database passwords)
VIEW_MODULE_CONFIG_FOR_MODULE	User can see (but not change) module configuration information (not including database passwords) for a specific module id for a node id
VIEW_MODULE_STATUS	User can see (but not change) status information about modules.
VIEW_TRANSACTION_LOG	User is allowed to view the transaction log
VIEW_TRANSACTION_LOG_EVENT	User is allowed to view entries in the transaction log
VIEW_USERS	User can view list of users

Method Summary

Modifier and Type	Method	Description
static String	extractFirstSpaceSeparatedArgument(String theArgument)
static Collection<String>	extractSpaceSeparatedResourceTypesFromArgument(String theArgument)
static Collection<String>	extractSpaceSeparatedResourceTypesFromArgument(String theArgument, int theFromOffsetIndex)
static Optional<PermissionEnum>	find(String thePermission)
static List<PermissionEnum>	findAll(List<String> thePermissions)
Set<PermissionCategoryEnum>	getCategories()	Deprecated.
PermissionCategoryEnum	getCategory()
PermissionArgumentFormat<?>	getFormat()	The format for the argument - defaults to NoArgument format
Set<PermissionEnum>	getImplies()
boolean	isArgumentOptional()
boolean	isExpungePermission()
boolean	isFhirPermission()	Determines if this is a FHIR related permission.
boolean	isNegative()
boolean	isRequiresArgument()
boolean	isSuperuser()	Determines if this is a FHIR delete permission.
boolean	isSystemPermission()
boolean	isTakesArgument()
static Set<PermissionEnum>	roles()	Deprecated.
static void	validateInheritedPermissionsFormat(PermissionEnum[] theImplies, PermissionArgumentFormat<?> theFormat)
static PermissionEnum	valueOf(String name)	Returns the enum constant of this class with the specified name.
static PermissionEnum[]	values()	Returns an array containing the constants of this enum class, in the order they are declared.

Methods inherited from class java.lang.Enum

clone, compareTo, describeConstable, equals, finalize, getDeclaringClass, hashCode, name, ordinal, toString, valueOf

Methods inherited from class java.lang.Object

getClass, notify, notifyAll, wait, wait, wait

Enum Constant Details

CHANGE_OWN_PASSWORD

public static final PermissionEnum CHANGE_OWN_PASSWORD

User has permission to change password

ACCESS_EASYSHARE

public static final PermissionEnum ACCESS_EASYSHARE

User can log in to EasyShare

EASYSHARE_CREATE_SMART_HEALTH_LINK

public static final PermissionEnum EASYSHARE_CREATE_SMART_HEALTH_LINK

User can create a SMART Health Link using EasyShare

CHANGE_OWN_DEFAULT_LAUNCH_CONTEXTS

public static final PermissionEnum CHANGE_OWN_DEFAULT_LAUNCH_CONTEXTS

User can update their own launch contexts

CHANGE_OWN_TFA_KEY

public static final PermissionEnum CHANGE_OWN_TFA_KEY

User can change their own TFA key

ACCESS_ADMIN_WEB

public static final PermissionEnum ACCESS_ADMIN_WEB

User is allowed to log into the web admin console

ACCESS_ADMIN_JSON

public static final PermissionEnum ACCESS_ADMIN_JSON

User is allowed to use the JSON Admin API services

ACCESS_FHIR_ENDPOINT

public static final PermissionEnum ACCESS_FHIR_ENDPOINT

User is allowed to access FHIR services

ACCESS_FHIRWEB

public static final PermissionEnum ACCESS_FHIRWEB

User has permission to log into the FHIRWeb console

VIEW_METRICS

public static final PermissionEnum VIEW_METRICS

User can access internal metrics API, including thread dump API

VIEW_MODULE_STATUS

public static final PermissionEnum VIEW_MODULE_STATUS

User can see (but not change) status information about modules. This includes running/stopped status, health checks, etc., but does not give access to more sensitive details such as logs.

VIEW_MODULE_CONFIG

public static final PermissionEnum VIEW_MODULE_CONFIG

User can see (but not change) module configuration information (not including database passwords)

ARCHIVE_MODULE

public static final PermissionEnum ARCHIVE_MODULE

User can archive module

REINSTATE_MODULE

public static final PermissionEnum REINSTATE_MODULE

User can reinstate module

OPENID_CONNECT_VIEW_CLIENT_LIST

public static final PermissionEnum OPENID_CONNECT_VIEW_CLIENT_LIST

User is allowed to view existing OpenID Connect client list

OPENID_CONNECT_VIEW_SERVER_LIST

public static final PermissionEnum OPENID_CONNECT_VIEW_SERVER_LIST

User is allowed to view existing OpenID Connect server list

OPENID_CONNECT_ADD_CLIENT

public static final PermissionEnum OPENID_CONNECT_ADD_CLIENT

User is allowed to create OpenID Connect clients

OIDC_CLIENT_PRESET_PERMISSION

public static final PermissionEnum OIDC_CLIENT_PRESET_PERMISSION

User is allowed to create OpenID Connect clients with pre-set permissions

OPENID_CONNECT_ADD_SERVER

public static final PermissionEnum OPENID_CONNECT_ADD_SERVER

User is allowed to add OpenID Connect servers

OPENID_CONNECT_EDIT_SERVER

public static final PermissionEnum OPENID_CONNECT_EDIT_SERVER

User is allowed to edit OpenID Connect servers

OPENID_CONNECT_EDIT_CLIENT

public static final PermissionEnum OPENID_CONNECT_EDIT_CLIENT

User is allowed to edit existing OpenID Connect clients

OPENID_CONNECT_MANAGE_GLOBAL_SESSIONS

public static final PermissionEnum OPENID_CONNECT_MANAGE_GLOBAL_SESSIONS

User is allows to manage other users' OIDC sessions (view active sessions and revoke them).

OPENID_CONNECT_MANAGE_KEYSTORES

public static final PermissionEnum OPENID_CONNECT_MANAGE_KEYSTORES

User is allowed to manage (view/create/update/delete) OIDC Keystore definitions

CREATE_USER

public static final PermissionEnum CREATE_USER

User can create other users

UPDATE_USER

public static final PermissionEnum UPDATE_USER

User can update existing users other than themself

VIEW_USERS

public static final PermissionEnum VIEW_USERS

User can view list of users

SAVE_USER

public static final PermissionEnum SAVE_USER

User can view, create, and update users

ROLE_FHIR_CLIENT

public static final PermissionEnum ROLE_FHIR_CLIENT

User is allowed to use a FHIR client

ROLE_SYSTEM

public static final PermissionEnum ROLE_SYSTEM

Actions performed by the system itself. Implied permissions are populated internally and not explicitly defined in the constructor.

ROLE_SYSTEM_INITIALIZATION

public static final PermissionEnum ROLE_SYSTEM_INITIALIZATION

Actions performed by the system itself during initialization

VIEW_AUDIT_LOG

public static final PermissionEnum VIEW_AUDIT_LOG

User is allowed to view the audit log

VIEW_TRANSACTION_LOG

public static final PermissionEnum VIEW_TRANSACTION_LOG

User is allowed to view the transaction log

VIEW_TRANSACTION_LOG_EVENT

public static final PermissionEnum VIEW_TRANSACTION_LOG_EVENT

User is allowed to view entries in the transaction log

UPDATE_MODULE_CONFIG

public static final PermissionEnum UPDATE_MODULE_CONFIG

User is allows to modify a module's configuration

START_STOP_MODULE

public static final PermissionEnum START_STOP_MODULE

User is allowed to start/stop modules

CONTROL_MODULE

public static final PermissionEnum CONTROL_MODULE

User can start/stop/restart modules

CREATE_MODULE

public static final PermissionEnum CREATE_MODULE

User is allowed to create new modules

MODULE_ADMIN

public static final PermissionEnum MODULE_ADMIN

User is allowed to create, reconfigure and start/stop modules

FHIR_ACCESS_PARTITION_ALL

public static final PermissionEnum FHIR_ACCESS_PARTITION_ALL

User is allowed to access (includes both read and write operations) data in all partitions. Note that this permission does not actually authorize any specific read/write operations, it simply implies access to the partitions.

FHIR_ACCESS_PARTITION_NAME

public static final PermissionEnum FHIR_ACCESS_PARTITION_NAME

User is allowed to access (includes both read and write operations) data in the given partition. Note that this permission does not actually authorize any specific read/write operations, it simply implies access to the given partition.

FHIR_OP_BINARY_ACCESS_READ

public static final PermissionEnum FHIR_OP_BINARY_ACCESS_READ

User is allowed to invoke the $binary-access-XXX operation (note that the user will also need permission to read/write the individual resource that is actually being accessed)

FHIR_OP_BINARY_ACCESS_WRITE

public static final PermissionEnum FHIR_OP_BINARY_ACCESS_WRITE

User is allowed to invoke the $binary-access-XXX operation (note that the user will also need permission to read/write the individual resource that is actually being accessed)

FHIR_OP_INITIATE_BULK_DATA_EXPORT

public static final PermissionEnum FHIR_OP_INITIATE_BULK_DATA_EXPORT

User is allowed to initiate a bulk data export using the $export operation

FHIR_OP_INITIATE_BULK_DATA_IMPORT

public static final PermissionEnum FHIR_OP_INITIATE_BULK_DATA_IMPORT

User is allowed to initiate a bulk data import using the $import operation

FHIR_OP_INITIATE_BULK_DATA_EXPORT_GROUP

public static final PermissionEnum FHIR_OP_INITIATE_BULK_DATA_EXPORT_GROUP

Bulk export - group Level

FHIR_OP_INITIATE_BULK_DATA_EXPORT_PATIENT

@Deprecated
public static final PermissionEnum FHIR_OP_INITIATE_BULK_DATA_EXPORT_PATIENT

Deprecated.

In favour of FHIR_OP_INITIATE_BULK_DATA_EXPORT_PATIENTS and FHIR_OP_INITIATE_BULK_DATA_EXPORT_ALL_PATIENTS

Bulk export - Patient Level

FHIR_OP_INITIATE_BULK_DATA_EXPORT_PATIENTS

public static final PermissionEnum FHIR_OP_INITIATE_BULK_DATA_EXPORT_PATIENTS

Bulk Export for a list of patient IDs and resource types

FHIR_OP_INITIATE_BULK_DATA_EXPORT_ALL_PATIENTS

public static final PermissionEnum FHIR_OP_INITIATE_BULK_DATA_EXPORT_ALL_PATIENTS

Bulk Export for all patients

FHIR_OP_INITIATE_BULK_DATA_EXPORT_SYSTEM

public static final PermissionEnum FHIR_OP_INITIATE_BULK_DATA_EXPORT_SYSTEM

Bulk export - System Level

FHIR_READ_SEARCH_PARAMETERS

public static final PermissionEnum FHIR_READ_SEARCH_PARAMETERS

User is allowed to read search parameters

FHIR_MODIFY_SEARCH_PARAMETERS

public static final PermissionEnum FHIR_MODIFY_SEARCH_PARAMETERS

User is allowed to create, update, and delete search parameters

FHIR_READ_ALL_IN_COMPARTMENT

public static final PermissionEnum FHIR_READ_ALL_IN_COMPARTMENT

User is allowed to read any resources in the given compartment

FHIR_WRITE_ALL_IN_COMPARTMENT

public static final PermissionEnum FHIR_WRITE_ALL_IN_COMPARTMENT

User is allowed to write any resources in the given compartment

FHIR_READ_TYPE_IN_COMPARTMENT

public static final PermissionEnum FHIR_READ_TYPE_IN_COMPARTMENT

User is allowed to read any resources of the given type in the given compartment

FHIR_WRITE_TYPE_IN_COMPARTMENT

public static final PermissionEnum FHIR_WRITE_TYPE_IN_COMPARTMENT

User is allowed to write any resources of the given type in the given compartment

FHIR_READ_ALL_OF_TYPE

public static final PermissionEnum FHIR_READ_ALL_OF_TYPE

User is allowed to read any resources of the given type

FHIR_WRITE_ALL_OF_TYPE

public static final PermissionEnum FHIR_WRITE_ALL_OF_TYPE

User is allowed to write any resources of the given type

FHIR_READ_INSTANCE

public static final PermissionEnum FHIR_READ_INSTANCE

User is allowed to read a specific resource instance by ID

FHIR_WRITE_INSTANCE

public static final PermissionEnum FHIR_WRITE_INSTANCE

User is allowed to write a specific resource instance by ID

BLOCK_FHIR_READ_UNLESS_CODE_IN_VS

public static final PermissionEnum BLOCK_FHIR_READ_UNLESS_CODE_IN_VS

User is allowed to access resources with a code

BLOCK_FHIR_READ_UNLESS_CODE_NOT_IN_VS

public static final PermissionEnum BLOCK_FHIR_READ_UNLESS_CODE_NOT_IN_VS

User is allowed to access resources with a code

FHIR_EXPUNGE_DELETED

public static final PermissionEnum FHIR_EXPUNGE_DELETED

User is permitted to invoke the $expunge operation with expungeDeletedResources=true

FHIR_EXPUNGE_PREVIOUS_VERSIONS

public static final PermissionEnum FHIR_EXPUNGE_PREVIOUS_VERSIONS

User is permitted to invoke the $expunge operation with expungePreviousVersions=true

FHIR_EXPUNGE_EVERYTHING

public static final PermissionEnum FHIR_EXPUNGE_EVERYTHING

User is permitted to invoke the $expunge operation with expungeEverything=true

FHIR_DELETE_EXPUNGE

public static final PermissionEnum FHIR_DELETE_EXPUNGE

User is permitted to invoke the $delete-expunge operation

FHIR_LIVEBUNDLE

public static final PermissionEnum FHIR_LIVEBUNDLE

User is permitted to invoke the $livebundle-watchlist-add, $livebundle-watchlist-delete, $livebundle-watchlist, and $livebundle operations

FHIR_MANAGE_PARTITIONS

public static final PermissionEnum FHIR_MANAGE_PARTITIONS

User is permitted to invoke the operations $partition-management-create-partition, $partition-management-read-partition, $partition-management-update-partition, $partition-management-delete-partition, $partition-management-list-partitions,

FHIR_META_OPERATIONS_SUPERUSER

public static final PermissionEnum FHIR_META_OPERATIONS_SUPERUSER

User is permitted to invoke the $meta, $meta-add, and $meta-delete operations on any resource.

FHIR_EXTENDED_OPERATION_SUPERUSER

public static final PermissionEnum FHIR_EXTENDED_OPERATION_SUPERUSER

User may invoke any kind of operation

FHIR_EXTENDED_OPERATION_ON_SERVER

public static final PermissionEnum FHIR_EXTENDED_OPERATION_ON_SERVER

User may invoke operation with name specified by argument (e.g. $fooOperation)

FHIR_EXTENDED_OPERATION_ON_TYPE

public static final PermissionEnum FHIR_EXTENDED_OPERATION_ON_TYPE

User may invoke operation at the type level with type and name specified by argument (e.g. Patient/$fooOperation)

FHIR_EXTENDED_OPERATION_ON_ANY_INSTANCE

public static final PermissionEnum FHIR_EXTENDED_OPERATION_ON_ANY_INSTANCE

User may invoke operation at the instance level for any type with name specified by argument (e.g. $fooOperation)

FHIR_EXTENDED_OPERATION_ON_ANY_INSTANCE_OF_TYPE

public static final PermissionEnum FHIR_EXTENDED_OPERATION_ON_ANY_INSTANCE_OF_TYPE

User may invoke operation at the instance level with type and name specified by argument (e.g. Patient/$fooOperation)

FHIR_OP_PATIENT_MATCH

public static final PermissionEnum FHIR_OP_PATIENT_MATCH

User may invoke the MDM $match operation on a Patient

FHIR_OP_MDM_MERGE_GOLDEN_RESOURCES

public static final PermissionEnum FHIR_OP_MDM_MERGE_GOLDEN_RESOURCES

User may invoke the MDM $mdm-merge-golden-resources operation on Golden Resources

FHIR_OP_MDM_UPDATE_LINK

public static final PermissionEnum FHIR_OP_MDM_UPDATE_LINK

User may invoke the MDM $mdm-update-link operation on a Golden Resource

FHIR_OP_MDM_CREATE_LINK

public static final PermissionEnum FHIR_OP_MDM_CREATE_LINK

User may invoke the MDM $mdm-create-link operation on a Golden Resource

FHIR_OP_MDM_QUERY_LINKS

public static final PermissionEnum FHIR_OP_MDM_QUERY_LINKS

User may invoke the MDM $mdm-query-links operation

FHIR_OP_MDM_LINK_HISTORY

public static final PermissionEnum FHIR_OP_MDM_LINK_HISTORY

User may invoke the MDM $mdm-query-links operation

FHIR_OP_MDM_DUPLICATE_GOLDEN_RESOURCES

public static final PermissionEnum FHIR_OP_MDM_DUPLICATE_GOLDEN_RESOURCES

User may invoke the MDM $mdm-duplicate-golden-resources

FHIR_OP_MDM_NOT_DUPLICATE

public static final PermissionEnum FHIR_OP_MDM_NOT_DUPLICATE

User may invoke the MDM $mdm-not-duplicate

FHIR_OP_MDM_CLEAR

public static final PermissionEnum FHIR_OP_MDM_CLEAR

User may invoke the MDM $mdm-clear Operation

FHIR_OP_MDM_SUBMIT

public static final PermissionEnum FHIR_OP_MDM_SUBMIT

User may invoke the MDM $mdm-submit operation

FHIR_MDM_ADMIN

public static final PermissionEnum FHIR_MDM_ADMIN

User may perform all MDM operations

FHIR_OP_EMPI_MERGE_PERSONS

public static final PermissionEnum FHIR_OP_EMPI_MERGE_PERSONS

Legacy permission for backward compatibility. Use corresponding MDM permission instead.

FHIR_OP_EMPI_UPDATE_LINK

public static final PermissionEnum FHIR_OP_EMPI_UPDATE_LINK

Legacy permission for backward compatibility. Use corresponding MDM permission instead.

FHIR_OP_EMPI_QUERY_LINKS

public static final PermissionEnum FHIR_OP_EMPI_QUERY_LINKS

Legacy permission for backward compatibility. Use corresponding MDM permission instead.

FHIR_OP_EMPI_DUPLICATE_PERSONS

public static final PermissionEnum FHIR_OP_EMPI_DUPLICATE_PERSONS

Legacy permission for backward compatibility. Use corresponding MDM permission instead.

FHIR_OP_EMPI_CLEAR

public static final PermissionEnum FHIR_OP_EMPI_CLEAR

Legacy permission for backward compatibility. Use corresponding MDM permission instead.

FHIR_OP_EMPI_SUBMIT

public static final PermissionEnum FHIR_OP_EMPI_SUBMIT

Legacy permission for backward compatibility. Use corresponding MDM permission instead.

FHIR_EMPI_ADMIN

public static final PermissionEnum FHIR_EMPI_ADMIN

Legacy permission for backward compatibility. Use corresponding MDM permission instead.

FHIR_OP_EVALUATE_MEASURE

public static final PermissionEnum FHIR_OP_EVALUATE_MEASURE

CQL Permission for evaluate-measure operation.

FHIR_OP_SUBMIT_DATA

public static final PermissionEnum FHIR_OP_SUBMIT_DATA

Permission for submit-data operation.

FHIR_OP_CARE_GAPS

public static final PermissionEnum FHIR_OP_CARE_GAPS

Permission for care-gaps operation.

FHIR_OP_EVALUATE

public static final PermissionEnum FHIR_OP_EVALUATE

Permission for evaluate operation.

FHIR_OP_COLLECTDATA

public static final PermissionEnum FHIR_OP_COLLECTDATA

Permission for $collect-data operation.

FHIR_OP_DATAREQUIREMENTS

public static final PermissionEnum FHIR_OP_DATAREQUIREMENTS

Permission for $data-requirements operation.

FHIR_OP_CQL

public static final PermissionEnum FHIR_OP_CQL

Permission for cql operation.

FHIR_OP_EVALUATE_MEASURES

public static final PermissionEnum FHIR_OP_EVALUATE_MEASURES

Permission for evaluate-measures operation.

DQM_QPP_BUILD

public static final PermissionEnum DQM_QPP_BUILD

Permission for qpp-build operation.

BATCH_JOB_ANALYTICS

public static final PermissionEnum BATCH_JOB_ANALYTICS

Permission for job-analytics operation

FHIR_OP_APPLY

public static final PermissionEnum FHIR_OP_APPLY

User is permitted to call the $apply operation

FHIR_OP_PREPOPULATE

public static final PermissionEnum FHIR_OP_PREPOPULATE

User is permitted to call the $prepopulate operation

FHIR_OP_POPULATE

public static final PermissionEnum FHIR_OP_POPULATE

User is permitted to call the $populate operation

FHIR_OP_EXTRACT

public static final PermissionEnum FHIR_OP_EXTRACT

User is permitted to call the $extract operation

FHIR_OP_PACKAGE

public static final PermissionEnum FHIR_OP_PACKAGE

User is permitted to call the $package operation

FHIR_DTR_USER

public static final PermissionEnum FHIR_DTR_USER

User may perform all DTR operations

FHIR_ALL_READ

public static final PermissionEnum FHIR_ALL_READ

User is allowed to perform any FHIR read/access-to-data operation, e.g. `read`, `search`, `history`, etc

FHIR_TRANSACTION

public static final PermissionEnum FHIR_TRANSACTION

User is allowed to perform FHIR transactions

FHIR_GRAPHQL

public static final PermissionEnum FHIR_GRAPHQL

User is allowed to perform FHIR GraphQL Operations

FHIR_BATCH

public static final PermissionEnum FHIR_BATCH

User is allowed to perform FHIR transactions

FHIR_PATCH

@Deprecated
public static final PermissionEnum FHIR_PATCH

Deprecated.

FHIR_PATCH will be removed: Users should instead be granted more granular write permissions that cover PATCH operations.

User is allowed to perform FHIR PATCH operations

FHIR_ALL_WRITE

public static final PermissionEnum FHIR_ALL_WRITE

User is allowed to perform any FHIR write/modify operation, e.g. `create`, `update`, etc

FHIR_ALL_DELETE

public static final PermissionEnum FHIR_ALL_DELETE

User is allowed to perform any FHIR delete operation

FHIR_DELETE_ALL_OF_TYPE

public static final PermissionEnum FHIR_DELETE_ALL_OF_TYPE

User is allowed to perform any FHIR delete operation on the given type

FHIR_DELETE_ALL_IN_COMPARTMENT

public static final PermissionEnum FHIR_DELETE_ALL_IN_COMPARTMENT

User is allowed to perform any FHIR delete operation on a given compartment

FHIR_DELETE_TYPE_IN_COMPARTMENT

public static final PermissionEnum FHIR_DELETE_TYPE_IN_COMPARTMENT

User is allowed to perform any FHIR delete operation on a given compartment

FHIR_DELETE_CASCADE_ALLOWED

public static final PermissionEnum FHIR_DELETE_CASCADE_ALLOWED

Any delete permissions granted to the user may be applied to cascaded deletes as well as normal deletes. Note that this permission allows cascaded deletes to occur, but does not actually grant any permission to delete resources in the first place. This permission must be combined with other permissions that grant the ability to cascade deletes.

FHIR_CAPABILITIES

public static final PermissionEnum FHIR_CAPABILITIES

User is allowed to access the server capability statement

FHIR_MANUAL_VALIDATION

public static final PermissionEnum FHIR_MANUAL_VALIDATION

User is allowed to invoke the `$validate` operation to validate resources

FHIR_PROCESS_MESSAGE

public static final PermissionEnum FHIR_PROCESS_MESSAGE

User is allowed to invoke the `$process-message` operation to accept a message

FHIR_UPLOAD_EXTERNAL_TERMINOLOGY

public static final PermissionEnum FHIR_UPLOAD_EXTERNAL_TERMINOLOGY

User is permitted to upload external code systems

FHIR_GET_RESOURCE_COUNTS

public static final PermissionEnum FHIR_GET_RESOURCE_COUNTS

User is permitted to call the $get-resource-counts operation

FHIR_TRIGGER_SUBSCRIPTION

public static final PermissionEnum FHIR_TRIGGER_SUBSCRIPTION

User is allowed to invoke the $trigger-subscription operation

ROLE_FHIR_TERMINOLOGY_READ_CLIENT

public static final PermissionEnum ROLE_FHIR_TERMINOLOGY_READ_CLIENT

User is permitted to call read-only terminology methods, such as $lookup, $validate-code

FHIR_OP_PATIENT_EVERYTHING

public static final PermissionEnum FHIR_OP_PATIENT_EVERYTHING

User is allowed to perform the patient $everything operation

FHIR_OP_PATIENT_EVERYTHING_ACCESS_ALL

public static final PermissionEnum FHIR_OP_PATIENT_EVERYTHING_ACCESS_ALL

User is allowed to perform the patient $everything operation with `Access All` permission

FHIR_OP_PATIENT_SUMMARY

public static final PermissionEnum FHIR_OP_PATIENT_SUMMARY

User is allowed to perform the patient $summary operation

FHIR_OP_ENCOUNTER_EVERYTHING

public static final PermissionEnum FHIR_OP_ENCOUNTER_EVERYTHING

User is allowed to perform the encounter $everything operation

FHIR_OP_STRUCTUREDEFINITION_SNAPSHOT

public static final PermissionEnum FHIR_OP_STRUCTUREDEFINITION_SNAPSHOT

User is allowed to perform the $snapshot operation

FHIR_OP_MEMBER_MATCH

public static final PermissionEnum FHIR_OP_MEMBER_MATCH

User is allowed to perform the $member-match operation

HFQL_EXECUTE

public static final PermissionEnum HFQL_EXECUTE

User is allowed to execute HFQL queries

ROLE_FHIR_CLIENT_SUPERUSER_RO

public static final PermissionEnum ROLE_FHIR_CLIENT_SUPERUSER_RO

Any read functions

ROLE_FHIR_CLIENT_SUPERUSER

public static final PermissionEnum ROLE_FHIR_CLIENT_SUPERUSER

User has permission to perform any standard FHIR client operation (does not imply superuser status for other parts of the CDR, e.g. user management, FHIR search parameter modification, etc) Implied permissions are populated internally and not explicitly defined in the constructor.

ROLE_SUPERUSER

public static final PermissionEnum ROLE_SUPERUSER

User has all permissions to do anything Implied permissions are populated internally and not explicitly defined in the constructor.

ROLE_ANONYMOUS

public static final PermissionEnum ROLE_ANONYMOUS

User is not logged in or has not supplied credentials

ETL_IMPORT_PROCESS_FILE

public static final PermissionEnum ETL_IMPORT_PROCESS_FILE

User is allowed to initiate processing an ETL job

VIEW_CDA_TEMPLATE

public static final PermissionEnum VIEW_CDA_TEMPLATE

User is allowed to view CDA Document Templates

CREATE_CDA_TEMPLATE

public static final PermissionEnum CREATE_CDA_TEMPLATE

User is allowed to create new CDA Document Templates

DELETE_CDA_TEMPLATE

public static final PermissionEnum DELETE_CDA_TEMPLATE

User is allowed to delete CDA Document Templates

USE_CDA_TEMPLATE

public static final PermissionEnum USE_CDA_TEMPLATE

User is allowed to use CDA Document Templates, potentially persisting a Composition, Bundle, and returning sensitive information in the resultant XML

MDM_UPDATE_MATCH_RULES

public static final PermissionEnum MDM_UPDATE_MATCH_RULES

User can set/update MDM match rules

MDM_VIEW_MATCH_RULES

public static final PermissionEnum MDM_VIEW_MATCH_RULES

User can see MDM match rules

MDM_ADMIN

public static final PermissionEnum MDM_ADMIN

User can perform any MDM operations

FHIR_AUTO_MDM

public static final PermissionEnum FHIR_AUTO_MDM

User will have MDM expansion performed automatically on all queries

EMPI_UPDATE_MATCH_RULES

public static final PermissionEnum EMPI_UPDATE_MATCH_RULES

Legacy permission for backward compatibility. Use corresponding MDM permission instead.

EMPI_VIEW_MATCH_RULES

public static final PermissionEnum EMPI_VIEW_MATCH_RULES

Legacy permission for backward compatibility. Use corresponding MDM permission instead.

EMPI_ADMIN

public static final PermissionEnum EMPI_ADMIN

Legacy permission for backward compatibility. Use corresponding MDM permission instead.

PACKAGE_REGISTRY_READ

public static final PermissionEnum PACKAGE_REGISTRY_READ

User can perform read operations from the package registry

PACKAGE_REGISTRY_WRITE

public static final PermissionEnum PACKAGE_REGISTRY_WRITE

User can perform read operations from the package registry

INVOKE_CDS_HOOKS

public static final PermissionEnum INVOKE_CDS_HOOKS

User can call CDS Hooks

AG_ADMIN_CONSOLE_READ

public static final PermissionEnum AG_ADMIN_CONSOLE_READ

User can perform read operations from the appSphere Admin Console

AG_ADMIN_CONSOLE_WRITE

public static final PermissionEnum AG_ADMIN_CONSOLE_WRITE

User can perform write operations from the appSphere Admin Console

AG_DEV_PORTAL_READ

public static final PermissionEnum AG_DEV_PORTAL_READ

User can perform read operations from the appSphere Developer Portal

AG_DEV_PORTAL_WRITE

public static final PermissionEnum AG_DEV_PORTAL_WRITE

User can perform write operations from the appSphere Developer Portal

VIEW_BATCH_JOBS

public static final PermissionEnum VIEW_BATCH_JOBS

User has permission to view batch jobs

MANAGE_BATCH_JOBS

public static final PermissionEnum MANAGE_BATCH_JOBS

User has permission to manage (modify) batch jobs

DOCREF

public static final PermissionEnum DOCREF

User can perform a docref operation

CDA_IMPORT

public static final PermissionEnum CDA_IMPORT

User can perform a CDA Import operation

FHIR_UPDATE_REWRITE_HISTORY

public static final PermissionEnum FHIR_UPDATE_REWRITE_HISTORY

User can perform an update on the historical version of a resource

SUBMIT_ATTACHMENT

public static final PermissionEnum SUBMIT_ATTACHMENT

VIEW_MODULE_CONFIG_FOR_MODULE

public static final PermissionEnum VIEW_MODULE_CONFIG_FOR_MODULE

User can see (but not change) module configuration information (not including database passwords) for a specific module id for a node id

UPDATE_MODULE_CONFIG_FOR_MODULE

public static final PermissionEnum UPDATE_MODULE_CONFIG_FOR_MODULE

User is allowed to modify a specific module id's configuration for a node id

START_STOP_MODULE_FOR_MODULE

public static final PermissionEnum START_STOP_MODULE_FOR_MODULE

User is allowed to start/stop a specific module id for a node id

CONTROL_MODULE_FOR_MODULE

public static final PermissionEnum CONTROL_MODULE_FOR_MODULE

User can start/stop/restart a specific module id for a node id

MODULE_ADMIN_FOR_MODULE

public static final PermissionEnum MODULE_ADMIN_FOR_MODULE

User is allowed to reconfigure and start/stop a specific module id for a node id

ROLE_MDMUI_DATASTEWARD_FHIR

public static final PermissionEnum ROLE_MDMUI_DATASTEWARD_FHIR

ROLE_MDMUI_ADMIN_FHIR

public static final PermissionEnum ROLE_MDMUI_ADMIN_FHIR

Method Details

values

public static PermissionEnum[] values()

Returns an array containing the constants of this enum class, in the order they are declared.

Returns:

an array containing the constants of this enum class, in the order they are declared

valueOf

public static PermissionEnum valueOf(String name)

Returns the enum constant of this class with the specified name. The string must match exactly an identifier used to declare an enum constant in this class. (Extraneous whitespace characters are not permitted.)

Parameters:

name - the name of the enum constant to be returned.

Returns:

the enum constant with the specified name

Throws:

IllegalArgumentException - if this enum class has no constant with the specified name

NullPointerException - if the argument is null

validateInheritedPermissionsFormat

public static void validateInheritedPermissionsFormat(PermissionEnum[] theImplies,
 PermissionArgumentFormat<?> theFormat)

getCategories

@Deprecated(since="7.2.0")
public Set<PermissionCategoryEnum> getCategories()

Deprecated.

getCategory

public PermissionCategoryEnum getCategory()

getImplies

public Set<PermissionEnum> getImplies()

isSystemPermission

public boolean isSystemPermission()

isTakesArgument

public boolean isTakesArgument()

isRequiresArgument

public boolean isRequiresArgument()

isArgumentOptional

public boolean isArgumentOptional()

isNegative

public boolean isNegative()

getFormat

public PermissionArgumentFormat<?> getFormat()

The format for the argument - defaults to NoArgument format

find

@Nonnull
public static Optional<PermissionEnum> find(String thePermission)

findAll

@Nonnull
public static List<PermissionEnum> findAll(List<String> thePermissions)

roles

@Deprecated(since="7.2.0")
public static Set<PermissionEnum> roles()

Deprecated.

extractFirstSpaceSeparatedArgument

public static String extractFirstSpaceSeparatedArgument(String theArgument)

extractSpaceSeparatedResourceTypesFromArgument

public static Collection<String> extractSpaceSeparatedResourceTypesFromArgument(String theArgument)

extractSpaceSeparatedResourceTypesFromArgument

public static Collection<String> extractSpaceSeparatedResourceTypesFromArgument(String theArgument,
 int theFromOffsetIndex)

isExpungePermission

public boolean isExpungePermission()

isSuperuser

public boolean isSuperuser()

Determines if this is a FHIR delete permission.

Returns:

true if FHIR delete, false otherwise

isFhirPermission

public boolean isFhirPermission()

Determines if this is a FHIR related permission.

Returns:

true if FHIR permission, false otherwise