Table des matières
Moodle Load Monitor: capabilities and services
This page summarises the access rights of the tool_moodleload component, the web service it declares, the roles and account created at installation, and what is removed at uninstallation. It serves as a reference for administrators who need to audit or restrict access.
Capabilities
Both capabilities are defined at the system context level and granted by default to the Manager role (manager archetype). No other role receives them.
| Capability | Type | Context | Manager | Allows |
|---|---|---|---|---|
tool/moodleload:readmetrics | Read | System | yes | Read the host metrics (dashboard and tool_moodleload_get_metrics function), answer the load test authorisation handshake (tool_moodleload_authorize_load). |
tool/moodleload:setuptests | Write | System | yes | Prepare the test material: validate an uploaded file, restore the test course, create or update the test users and their enrolments. |
Additional controls, outside the plugin's capabilities:
- The engine status view (
view.php) requires being a site administrator (moodle/site:config), whatever capabilities are assigned. - Restoring a course also requires, in the destination category, the standard Moodle capabilities
moodle/course:createandmoodle/restore:restorecourse. - Calling the service by token requires the user to hold
webservice/rest:use(see the dedicated role below).
The web service
| Property | Value |
|---|---|
| Name | Moodle Load Monitor |
| Short name | moodleload_monitor |
| Enabled | yes, at installation |
| Users | Restricted: only explicitly authorised users can obtain a token |
| File upload | allowed |
| File download | disabled |
| Protocol | REST |
Declared functions:
| Function | Type | AJAX session | Required capability |
|---|---|---|---|
tool_moodleload_get_metrics | Read | yes (the dashboard calls it with the user's session) | tool/moodleload:readmetrics |
tool_moodleload_authorize_load | Read | no | tool/moodleload:readmetrics |
app_moodleload_commit | Write | no | tool/moodleload:setuptests |
app_moodleload_restore_course | Write | no | tool/moodleload:setuptests |
app_moodleload_bulk_create_install_users | Write | no | tool/moodleload:setuptests |
The details of the parameters and responses are given in Moodle Load Monitor: web service.
To complete: the “ready to use” installation services of a test scenario and its resources, added after version 4.5.0010, are not yet described here. For each: name, role, parameters, required capability and effects on the site (resources created, items replaced).
What the installation creates
Provisioning is run at installation, replayed at upgrade on sites installed before this feature, and can be re-run safely.
| Item | Detail |
|---|---|
| Technical account | User moodleload (“Moodle Load Test Engine”), manual authentication, unknown random password, fictitious address moodleload@moodleload.invalid, emails disabled. An existing account with the same name is kept. |
| Authorisation | The account is added to the authorised users of the Moodle Load Monitor service. |
| Manager role | Assigned to the account in the system context, so that it can manage courses, categories and users. It carries the plugin's two capabilities. |
| Moodle Load web service role | Dedicated role (short name moodleloadws), which only carries webservice/rest:use. No default role has this capability: without it, the token would be refused for a user who is not an administrator. |
| Token | A permanent token on the service, valid for 3 months, not displayed and not renewed automatically. |
| Course category | Top-level category Load Tests, named according to the site language. |
| File area | The validated test material files are kept in the system context, component app_moodleload, one file per use. |
The two role assignments are tied to the component: they cannot be modified from the standard role assignment interface.
What uninstallation removes
- the service tokens, the account authorisation, the role assignments, the dedicated role;
- the Load Tests category if it is empty (otherwise it is kept);
- the uploaded test material files;
- the
moodleloadaccount, only if it was created by the plugin. A pre-existing account is not deleted: only what the plugin added to it is removed.
The test courses and users created by the write functions are not deleted by uninstallation.
Security recommendations
- The
moodleloadaccount is a site manager: treat its token like an administration credential, do not publish it, and let it expire or delete it when the tests are finished. - Do not install this component on a production site. Failing that, disable the service in Site administration / Server / Web services / External services and untick Allow load tests in the settings.
- Monitor the use of the write functions: restoring deletes an existing course with the same short name.
- Limit the tests in time and volume with the Allowed hours and Maximum load settings.
Back to the component index - Back to plugins index - Back to catalogue