================
 Get Acquainted
================

If you're new here, it's worth taking a moment to get some familiarity
with the "basic" web app.


Admin Users Can "Become Root"
-----------------------------

The first time you ever login, after creating your admin account,
you'll notice the top menu may be rather sparse.

Part of that is because the app doesn't do much yet and therefore has
few menu items to begin with.

But also it may be that your user account does not have *permission*
to see what the menu items point to.  If so such menu items will be
hidden.

So the first "trick" to know as an admin user, is that you may
**become root** (via user menu in top right of screen).  This will
bypass all permission checks so nothing is hidden from you.  You can
**stop being root** via the same user menu.

It's meant to (somewhat) mimic the ``sudo`` concept.  As a general
rule you should *not* make a habit of becoming root within the app
(unless e.g. for local development).  Instead you should grant
yourself permission to do the things you need, but keep certain "more
dangerous" features hidden unless you become root.


Users + Roles + Permissions
---------------------------

Technically all permission checks are done only for roles and never
for users.  Each user account may belong to zero or more roles, and
permissions are granted to roles as needed.

Even an "admin" user is really just a user account which belongs to
the **Administrator** role.  That is a special role though, meant only
to convey the power to "become root" as described above.

There are 3 special roles which are built-in and cannot be removed:

* Administrator
* Authenticated
* Anyone

We've explained Administrator already, but one more thing: If you want
to *assign* a particular user account to the Administrator role, you
must *always* become root to do so.

Authenticated and Anyone do not have users assigned directly to them.
Any user who has logged in will automatically belong to Authenticated,
and "everyone" belongs to the Anyone role *whether or not* they've
logged in.

Whereas permissions are not typically granted to the Administrator
role (it's just for becoming root), permissions *may* be granted to
the Authenticated and/or Anyone roles, as needed.

Beyond that, create as many roles as you like.  There is no limit to
the number of roles overall, or to the number of per-user role
assignments.

Note that roles do not "inherit" from each other; there is no
hierarchy.  A user may belong to zero or more roles, and each role may
be granted zero or more permissions.  A user's permissions are
"cumulative" based on their role membership.  And that's that.


Site Admin Role
---------------

Worth mentioning: the Site Admin role is typically auto-created for
new app installs.  This is meant to be the "daily driver" admin role,
to which you grant necessary permissions for someone who would
actually be administering the site.

But really it's just a helpful starting point.  This role is not
built-in; you can rename or remove it if you prefer.