<?xml version="1.0" encoding="UTF-8" ?>
<Elements>
  <!-- for now, only security related elements are available to add into the collection's config file
       using GLI's collection ConfigFileEditor that's available for GS3.
       See http://wiki.greenstone.org/doku.php?id=en:user:authentication
       and especially http://wiki.greenstone.org/doku.php?id=en:user_advanced:security
  -->

  <!-- Leave the elements in this file in this order for now.
       Code using this file (ConfigFileEditor.java) is dependent on ordering for ease of coding.
  -->
  
  <!-- element for hiding a collection -->
  <metadata name="public">false</metadata>

  <!-- element to make the entire collection private except for specified group(s) -->
  <security scope="collection" default_access="private">
    <exception>
      <group name="TYPE-GROUP-NAME-HERE"/>
      <!--<group name="KEEP-ADDING-ANOTHER-OF-THESE-TO-GIVE-ACCESS-TO-AN-ADDITIONAL-GROUP"/>-->
    </exception>
  </security>

  <!-- element to make all docs in collection private except for specified group(s).
       Can browse and search in collection, but docs found by browsing/searching can't be viewed -->
  <security scope="document" default_access="private">
    <exception>
      <group name="TYPE-GROUP-NAME-HERE"/>
      <!--<group name="KEEP-ADDING-ANOTHER-OF-THESE-TO-GIVE-ACCESS-TO-AN-ADDITIONAL-GROUP"/>-->
    </exception>
  </security>

  <!-- Make certain collection's docs private: except being some carefully defined set(s) of docs,
       which should then be made accessible only to the groups specified here as having access to
       those documentset(s).
       If different documentSets should be accessible to different groups, then define multipe
       <exception> elements here, each referencing the different docset(s) that exception pertains to.
  -->
  <security scope="document" default_access="public">
    
    <exception>
      <documentSet name="INVENT-A-RESTRICTED-DOCSET-NAME-HERE"/>
      <!--<documentSet name="CAN-HAVE-ADDITIONAL-DOCSETS"/>-->
      <group name="TYPE-GROUP-NAME-THAT-SHOULD-HAVE-ACCESS-TO-RESTRICTED-DOCSET(S)"/>
      <!--<group name="ADD-ANOTHER-OF-THESE-TO-GIVE-AN-ADDITIONAL-GROUP-ACCESS-TO-THE-SAME-DOCSET(S)"/>-->
    </exception>

    <documentSet name="REPEAT-INVENTED-RESTRICTED-DOCSET-NAME-HERE">
      <match type="match" field="TYPE-HERE-THE-METADATA-FIELD-NAME-WHOSE-VALUE-SHOULD-MATCH">TYPE-HERE-THE-METADATA-VALUE-THAT-SHOULD-EXACTLY-MATCH</match>
      <!--<match type="regex" field="TYPE-METADATA-FIELD-NAME">TYPE-HERE-THE-SO-CALLED-REGEX-PATTERN-THAT-THE-METADATA-VALUE-SHOULD-MATCH</match>-->
      <!--<match>TYPE-THE-DOC-IDENTIFIER-OF-RESTRICTED-DOC-HERE</match>-->
      
      <!--ADD AS MANY <match> elements as you like to define this documentSet-->
      
    </documentSet>
  </security>
  
</Elements>
