{{ :blocks:logo-apl.png?nolink |}} ===== Moodle Load Monitor: capabilities and services ===== This page summarises the access rights of the ''tool_moodleload'' component, the web service it declares, the roles and account created at installation, and what is removed at uninstallation. It serves as a reference for administrators who need to audit or restrict access. ==== Capabilities ==== Both capabilities are defined at the **system context** level and granted by default to the **Manager** role (//manager// archetype). No other role receives them. ^ Capability ^ Type ^ Context ^ Manager ^ Allows ^ | ''tool/moodleload:readmetrics'' | Read | System | yes | Read the host metrics (dashboard and ''tool_moodleload_get_metrics'' function), answer the load test authorisation handshake (''tool_moodleload_authorize_load''). | | ''tool/moodleload:setuptests'' | Write | System | yes | Prepare the test material: validate an uploaded file, restore the test course, create or update the test users and their enrolments. | Additional controls, outside the plugin's capabilities: * The **engine status view** (''view.php'') requires being a site administrator (''moodle/site:config''), whatever capabilities are assigned. * Restoring a course also requires, in the destination category, the standard Moodle capabilities ''moodle/course:create'' and ''moodle/restore:restorecourse''. * Calling the service by token requires the user to hold ''webservice/rest:use'' (see the dedicated role below). ==== The web service ==== ^ Property ^ Value ^ | Name | Moodle Load Monitor | | Short name | ''moodleload_monitor'' | | Enabled | yes, at installation | | Users | Restricted: only explicitly authorised users can obtain a token | | File upload | allowed | | File download | disabled | | Protocol | REST | Declared functions: ^ Function ^ Type ^ AJAX session ^ Required capability ^ | ''tool_moodleload_get_metrics'' | Read | yes (the dashboard calls it with the user's session) | ''tool/moodleload:readmetrics'' | | ''tool_moodleload_authorize_load'' | Read | no | ''tool/moodleload:readmetrics'' | | ''app_moodleload_commit'' | Write | no | ''tool/moodleload:setuptests'' | | ''app_moodleload_restore_course'' | Write | no | ''tool/moodleload:setuptests'' | | ''app_moodleload_bulk_create_install_users'' | Write | no | ''tool/moodleload:setuptests'' | The details of the parameters and responses are given in [[:tool:moodleload:webservice|Moodle Load Monitor: web service]]. //To complete: the "ready to use" installation services of a test scenario and its resources, added after version 4.5.0010, are not yet described here. For each: name, role, parameters, required capability and effects on the site (resources created, items replaced).// ==== What the installation creates ==== Provisioning is run at installation, replayed at upgrade on sites installed before this feature, and can be re-run safely. ^ Item ^ Detail ^ | Technical account | User ''moodleload'' ("Moodle Load Test Engine"), manual authentication, unknown random password, fictitious address ''moodleload@moodleload.invalid'', emails disabled. An existing account with the same name is kept. | | Authorisation | The account is added to the authorised users of the //Moodle Load Monitor// service. | | Manager role | Assigned to the account in the system context, so that it can manage courses, categories and users. It carries the plugin's two capabilities. | | //Moodle Load web service// role | Dedicated role (short name ''moodleloadws''), which only carries ''webservice/rest:use''. No default role has this capability: without it, the token would be refused for a user who is not an administrator. | | Token | A permanent token on the service, valid for 3 months, not displayed and not renewed automatically. | | Course category | Top-level category //Load Tests//, named according to the site language. | | File area | The validated test material files are kept in the system context, component ''app_moodleload'', one file per use. | The two role assignments are tied to the component: they cannot be modified from the standard role assignment interface. ==== What uninstallation removes ==== * the service tokens, the account authorisation, the role assignments, the dedicated role; * the //Load Tests// category if it is empty (otherwise it is kept); * the uploaded test material files; * the ''moodleload'' account, only if it was created by the plugin. A pre-existing account is not deleted: only what the plugin added to it is removed. The test courses and users created by the write functions are **not** deleted by uninstallation. ==== Security recommendations ==== * The ''moodleload'' account is a site manager: treat its token like an administration credential, do not publish it, and let it expire or delete it when the tests are finished. * Do not install this component on a production site. Failing that, disable the service in //Site administration / Server / Web services / External services// and untick //Allow load tests// in the settings. * Monitor the use of the write functions: restoring deletes an existing course with the same short name. * Limit the tests in time and volume with the //Allowed hours// and //Maximum load// settings. ---------- [[:tool:moodleload|Back to the component index]] - [[:Plugins|Back to plugins index]] - [[:start|Back to catalogue]]