Hi James,

Forgive my rambling, I’m working through deep memories as I write:

If I recall correctly, user_roles.pl by default defines two config items:

1. $c->{user_roles}, which associates a list of tokens with each role.

Those tokens (things like “edit-own-record” or “staff-view”) are each an alias for a list of specific actions defined in $PRIVMAP in EPrints/DataObj/User.pm (“staff-view” has things like “eprint/inbox/view”, “eprint/search/staff”, etc.)

And each one of those specific actions is asserted in the code using a check like:

$user->allow( "eprint/search/staff" );

#OR

$user->allow("eprint/inbox/view", $eprint);

2. $c->{roles} to define new repo-specific tokens/actions; for example in our repo we have:

$c->{roles}->{indexer} = [qw{ indexer/stop indexer/start indexer/force_start }];

# AND

$c->{user_roles}->{repo_manager} = [qw{ … indexer … }];

So working at it from the bottom up:

* in your screen plugin you’d have a test for: $user->allow("config/aam_update")

* in your $c->{roles} you’d define a new hat like: $c->{roles}->{aam-update} = [qw{ config/aam_update }];

* in your $c->{user_roles} you’d do something like: push(@{$c->{user_roles}->{admin}}, "aam-update");
(depending on your version of Perl, you might want to leave out that @{} )

Does that help?

Cheers

-- 
Matty Kerwin (he/him)