How can I have a dashboard that cannot be modifed by users?

Dear me,

The user dashboard is a document that is automatically copied from the default dashboard defined by the Admin. So you can set any permission you want on this "document". In your case, what you would do, is make sure everyone accesses the default dashboard (not theirs) and give read permission on the default dashboard that is by default restricted to the Administrator. So you need to follow several steps:

First Step : always display the default dashboard instead of the user dashboard to Studio

Add an xml contrib to studio so that the defaultdashboard is always displayed instead of the default. Here is the contrib to add in Studio :

<require>org.nuxeo.ecm.user.center.dashboard.opensocial.spaceprovider</require>
<extension target="org.nuxeo.ecm.spaces.core.spacemanager.service"
    point="spaceProviders">
    <spaceProvider name="userDashboardSpaceProvider">
      <class>
        org.nuxeo.ecm.user.center.dashboard.DefaultDashboardSpaceProvider
      </class>
    </spaceProvider>
  </extension>

Second step : add read permission to the defaultdashboard which is not the case by default

For an existing application

If the application is already deployed, the permission all already set on the default dashboard so we need to change them. We will need to access it, but this a not an easy access doc :) We will use Nuxeo Shell

Go to the adress :

yourServer/nuxeo/site/shell (in my case http://localhost:8080/nuxeo/site/shell), it should launch a java applet. Type the following commands :

connect -u Administrator (or whatever user is an Admin, it should prompt the pwd) 
cd management/dashboard-management/ (if you do a ls in there you'll see the defaultdashboardSpace) 
perms defaultDashboardSpace/ (it will show you the permissions) 
perms -grant "Everyone:Read" defaultDashboardSpace/ (it will update the property)

And then when you access the dashboard from a standard user (after redeploying the Studio project of course), you'll always see the same dashboard, in read-only mode.

For a new application (or a reset of the database)

The pb with the solution above is that if you redeploy a new database, you will have to redo the permission granting, which is not something you want. So let's use Studio to make sure we add the read permission whenever the defaultDashBoardSpace is created.

• Add the document type in the registries (AdvancedSettings >Registries> Doc Types :

  { doctypes: { Space: { parent:"Document",} } }

• Add an event handler on document created for type Space and with document path starts with : /management/dashboard-management/

• Add an automation chain that grant read permission to everyone and bind it to the event handler.

Deploy your bundle before anyone accesses the home dashboard on a newly created database and you are (should be) good to go!

One more thing

The dashboard cannot be modified by a non admin anymore but you still see the top right buttons for modifying it, it will show errors if you try to :)

If you want to remove those buttons, you will have to overidde the xhtml template layout of the page. The file you want to override is :

/nuxeo/addons/nuxeo-user-center/nuxeo-user-dashboard/nuxeo-user-dashboard-opensocial/src/main/resources/web/nuxeo.war/incl/dashboard/user_opensocial_dashboard.xhtml (to be updated whith the github link when it's back...)