Mngr: Created page with "= Namespaces and Lockdown Policy = == Costa Sano MediaWiki Platform == === Version 4.1 === == Purpose == This document describes the namespace architecture and access control configuration of the Costa Sano MediaWiki installation. It complements: * Data model version 4.1 * Identifier and numbering policy * Cargo + Page Forms implementation This page is intended for: * ICT successors * system maintainers * administrators It explains: * why namespaces exist * which..."

2026-02-03T13:53:29Z

Created page with "= Namespaces and Lockdown Policy = == Costa Sano MediaWiki Platform == === Version 4.1 === == Purpose == This document describes the namespace architecture and access control configuration of the Costa Sano MediaWiki installation. It complements: * Data model version 4.1 * Identifier and numbering policy * Cargo + Page Forms implementation This page is intended for: * ICT successors * system maintainers * administrators It explains: * why namespaces exist * which..."

New page

= Namespaces and Lockdown Policy =
== Costa Sano MediaWiki Platform ==
=== Version 4.1 ===

== Purpose ==

This document describes the namespace architecture and access control configuration of the Costa Sano MediaWiki installation.

It complements:

* Data model version 4.1
* Identifier and numbering policy
* Cargo + Page Forms implementation

This page is intended for:

* ICT successors
* system maintainers
* administrators

It explains:

* why namespaces exist
* which namespace is used for what
* which user groups may access each namespace
* how Lockdown protects content
* how this is configured in ''LocalSettings.php''

----

== Design principles ==

The namespace design follows these rules:

# One namespace per real-world entity type
# Plain English names (no technical abbreviations)
# Separation between documentation and research data
# Sensitive technical content must never be transcludable
# Simple, boring, maintainable configuration

Goals:

* clarity for non-technical users
* predictable URLs
* easy export and backup
* easy onboarding of successors
* minimal configuration complexity

----

== Namespace overview ==

{| class="wikitable"
! Namespace !! Purpose !! Typical pages !! Access group
|-
| Research:
| User documentation
| manuals, procedures
| research
|-
| ICT:
| Technical/system documentation
| server setup, backups, passwords, maintenance notes
| ict
|-
| Chapter:
| Research chapters (narrative structure)
| CH01, CH02, CH03
| club
|-
| Place:
| Geographic entities
| Oostende, Rome, Floréal
| club
|-
| Organisation:
| Institutions / organisations
| ARCH, CONG, etc.
| club
|-
| Person:
| People
| researchers, historical actors
| club
|-
| Heritage:
| Heritage objects
| buildings, sanatoria, artefacts
| club
|-
| Asset:
| DigitalAssets (numbered research sources)
| CH03-ROM-0007
| club
|}

----

== Naming rationale ==

Namespaces use full words instead of abbreviations.

Example:

* ''Asset:'' instead of ''DA:''
* ''Heritage:'' instead of ''HO:''

Reasons:

* self-explanatory
* easier for new users
* easier for successors
* avoids documentation overhead
* improves long-term maintainability

----

== Relationship to the data model ==

Namespaces map 1:1 to Cargo tables:

{| class="wikitable"
! Namespace !! Cargo table
|-
| Chapter:
| ResearchChapters
|-
| Place:
| Places
|-
| Organisation:
| Organisations
|-
| Person:
| Persons
|-
| Heritage:
| HeritageObjects
|-
| Asset:
| DigitalAssets
|}

Each page in these namespaces represents exactly one database entity.

The page name normally equals the entity identifier.

Example:

Asset:CH03-ROM-0007 → DigitalAssets.identifier

----

== Lockdown security model ==

The Lockdown extension restricts read/edit access per namespace.

Groups:

* research → user documentation only
* ict → system documentation only
* club → all research data
* sysop → full access

Policy:

* Research namespace → research group
* ICT namespace → ict group
* all research data namespaces → club group only

This ensures:

* technical information remains protected
* research data visible only to club members
* clear separation of responsibilities

----

== Transclusion protection ==

MediaWiki allows pages to be embedded (transcluded) into other pages.

This can bypass read restrictions.

To prevent leakage of sensitive system information:

ICT: is marked non-includable

Configuration:

$wgNonincludableNamespaces[] = NS_ICT;

Other namespaces are intentionally includable because:

* research content may be reused
* templates and summaries are useful
* no sensitive information is stored there

----

== Upload policy ==

Uploads are restricted globally.

Rules:

* normal users → cannot upload
* club members → upload allowed
* sysops → full rights

Rationale:

Digital files belong to DigitalAssets and must follow the identifier naming policy.
Uploads are therefore limited to trained members.

----

== LocalSettings.php configuration ==

The following block defines the namespaces and protection rules.

(Reference implementation – keep synchronized with this document.)

<syntaxhighlight lang="php">
wfLoadExtension( 'Lockdown' );

# namespaces
define("NS_RESEARCH", 3000);
define("NS_ICT", 3002);
define("NS_CHAPTER", 3004);
define("NS_PLACE", 3006);
define("NS_ORGANISATION", 3008);
define("NS_PERSON", 3010);
define("NS_HERITAGE", 3012);
define("NS_ASSET", 3014);

# permissions and lockdown configured accordingly
</syntaxhighlight>

See ''LocalSettings.php'' for the complete current configuration.

----

== Maintenance notes ==

When changing namespaces:

# update constants
# update Lockdown rules
# update VisualEditor namespace list
# search for old namespace names
# test with non-admin users

Never reuse old namespace IDs.

----

== Version history ==

{| class="wikitable"
! Version !! Date !! Notes
|-
| 4.1
| 2026
| Introduced full namespace separation, replaced HO/DA by Heritage/Asset, added Lockdown rules
|}

----

ICT:Namespaces and Lockdown Policy v4.1 - Revision history