Extending ACL

[winkiller]

Hey there,
I need a blog part for a page and of course my first idea was s9y, but there are some key features that may be a bit problematic with ACLs atm.

I wanted to seperate groups a bit more because I need one "group admin" of a usergroup with certain extended permissions and users in the group.

- group1+admin sees only posts in cat1 (ok)
- g1admin creates subcategories for cat1, but not for cat2...x (ok)
- grp1+admin automatically have read/write permissions (minor change to edit categories)
- some minor things like default posting to cat1 if you are in grp1 and not to rootdir (should be easy)

now the difficult part:
- g1admin shall edit posts of grp1 users, but not grp2...x

adminEntries: Administrate entries
adminEntriesMaintainOthers: Administrate other user's entries

these are not fine-grained enough for this
- same as categories the medialib should be separated completely. ( base/g1/ = grp1, /base/g2/ = grp2)

adminImagesMaintainOthers: Administrate other user's media files

Again, not fine-grained enough

Apart from that the "users" will have most config options disabled, they can only create entries, edit them, comment, tag, upload files.
The grp-admins can add users to their groups, remove them (choosing from a list pulled from external source) and edit the posts/comments of users in their group (but toggleable)

Is it possible to make that into a plugin or is it maybe even useful for HEAD or am I better off trying to patch the current code?

And yeah, I've already thought about using shared install, but I think that's not the right thing - because for example you can be groupadmin of more blogs and so you'd have a user account on many "spawned installations", quite much overhead

Anyone got some useful hints? Even: "you overlooked x and y and it's already possible" is fine.

And I deliberately put it into Development and not General because I'll add these features anyway, just thinking about best practice and possibly making it a new feature for s9y if wanted.

[garvinhicking]

Hi!

Actually, plugins should be able to add privileges on their own. BUT if you want to manage core functionality (create categories etc.), those plugin ACLs don't help you because you would need to edit core functionality for that.

I think if there's a good way to granulate the ACLs, that could very well be put into our SVN trunk, yes!

I don't have time right now to think more about what you want to do and if there's an easier approach. I'll try to re-read this posting somewhen next week though. As you wrote, this question is a little bit more complicated than usual questions here

Best regards,
Garvin