((p "Various API calls return a symbolic expression " (kbd "(rights ...)") ", where " (kbd "...") " is a sequence of zero or more symbols." " " "These symbols encode the access rights the user currently has.") (p "Valid symbols are: " (kbd "create") ", " (kbd "read") ", " (kbd "update") ", and " (kbd "delete") ".") (table (thead (tr (th "Symbol") (th "Meaning for user"))) (tbody (tr (td (kbd "create")) (td "May create a new zettel")) (tr (td (kbd "read")) (td "May read the zettel")) (tr (td (kbd "update")) (td "May update the zettel")) (tr (td (kbd "delete")) (td "May delete the zettel")))) (p "In practice, not all combinations of rights occur." " " "A Zettelstore in " (a ((href . "00001010000000#read-only")) "read-only mode") " always returns the symbol " (kbd "read") "." " " "A Zettelstore started by " (a ((href . "00001003000000")) "double-clicking") " returns either the expression " (kbd "(rights read update)") " or the expression " (kbd "(rights create read update delete)") " (all operations are allowed).") (p "If you have added an additional " (a ((href . "00001010040200")) "user") " to your Zettelstore, the returned rights may differ." " " "The access rights are determined by the " (a ((href . "00001010040100")) "enabled authentication") " settings, the " (a ((href . "00001010070300")) "user role") " of the current user, the " (a ((href . "00001010070200")) "visibility rules") " for a given zettel, and the " (a ((href . "00001006020400")) "read-only status") " for the zettel."))