Access control
Who can open a course, who can open a lesson, and what everyone else sees instead. This is the part of POM LMS that must be tested rather than assumed.
In this chapter
| Topic | Article |
|---|---|
| The whole model in one page | How access is decided |
| The exact order of checks | Access precedence |
| Requiring an account | Login gates |
| Roles, purchases, subscriptions and time windows | Permission-based access |
| Selling access to a course | Paid access |
| Different rules for one lesson | Lesson overrides |
| Opening a lesson to everyone | Preview access |
| What a blocked student experiences | The no-access experience |
| Testing it properly | Test access with different users |
The four mechanisms
| Mechanism | Set on | Answers |
|---|---|---|
| Login requirement | The course | Is the visitor signed in? |
| Permission rule | The course, or a lesson | Does this student match a rule? |
| Paid course | The course | Has this student bought the course? |
| Preview | A lesson | Is this lesson deliberately open? |
The order they are applied
- Login requirement. A signed-out visitor is blocked before anything else is considered.
- The lesson's own permission rule, when a lesson is being opened.
- The course's permission rule.
- The paid-course check, only when no rule applied.
- Otherwise, open.
Preview lessons bypass all of it, subject to the course's preview login setting.
The single most consequential consequence: a permission rule replaces the paid-course check. Setting both on one course means the rule decides and the paid setting is ignored.
The rule that governs this whole chapter
An administrator's view proves nothing.
Administrators generally satisfy or bypass the conditions students are measured against. Every access change must be verified with a real non-administrator account, in all three states:
- signed out;
- signed in without access;
- signed in with access.
Choose one model per course
Mixing mechanisms on a single course makes behavior hard to predict and harder to explain to a student who cannot get in.
| Need | Use |
|---|---|
| Anyone | Nothing |
| Any account | Login requirement |
| A role, a purchase, a subscription, a time window | A permission rule |
| One simple purchase | The paid-course setting |
| One lesson to behave differently | A preview, or a lesson rule |
Start with How access is decided.