A guest is basically everyone who does not have an account, i.e. no other associated role. Guests probably can't do much, but they can create an account.
Guests really don't need to see anything, just that the system “is there” and a screen to login and register. Registration is free to students and no one else needs to see anything.
The registration is completed by validating the email address and the user can now authenticate, to get access to all the methods of his Roles.
createStudentAccount(ident username, ident studentId, string lastName, string firstName, string email, string password, string code) {
assume not exists /account[username];
assume count(studentId, /account/student/id) = 0;
insert /
<account username=[username] lastName=[lastName] firstName=[firstName] email=[email] password=[password] code=[code]>
<student id=[studentId] />
</account>
}
validateAccount(ident username, string code) {
assume exists /account[username]/code; # implies existence of the account
assume /account[username]/code = code;
remove /account[username]/code;
}
authenticate(ident username, string password) {
assume exists /account[username];
assume /account[username]/password = password;
}