Some revo permissions questions

i somehow figure out more or less how permissions work, but i have still a lot of problems with it .. so here i have some questions

I made resource group and assigned permissions to one user group.
Mygroup / Member 9999 / Resource / web
Mygroup / Member 9999 / Resource / mgr

i also updated anonymouse group with
Mygroup / Member 9999 / Resource / web

1. Why isn’t enought to asign web context acces to anonymous group only ? i mean .. if i don’t define it to my group then users from that group are able to see those resources only if they aren’t logged in, and after they loggin they can’t see it anymore in frontend

2. If i define one group that can acces only to context-1 and then another group i assign that they can acces only to context-2 ... what happens if i assign one user to both groups ? what logic is here?

3. i created a resource group and successfuly hid some resources in manager to one user group, i want to hide some TV too. How i can do that ? ... when i created that TV i assigned acces permissions to my group (the same i used to hide resources) but all moderators still can see it when they edit some resourec wich uses that TV ...

4. How / Where i can limit manager acces to some components (in my case i need to limit gallery usage)?

thanx for the answers ...

I. If you add the users to the anonymous group, they can see the resources (although I’m not sure why you’d want to connect a resource group to the anonymous user group).

2. They should be able to see resources in both contexts.

3. You can assign the TVs to a category and create an Element Category Access ACL entry for them.

4. I’m not sure what you mean by limiting gallery usage, but #3 above might do what you want.

This may be helpful: http://bobsguides.com/revolution-permissions.html

1. i created a resource group "development" and i assigned to it some resources with javascript and css, those resources must be visible to all visitroes in frontend, but hidden to moderators in manager. I thought that logged users count as anonymouse too in frontend
2. why is so?... if i for one group define access for one and forbid for another, and in other group vice versa ... why not forbiden both ... it’s more logical to forbid both for me...
3. isn’t that only to hide under "elements" tab? .. well maybe that is a solution, but what’s the point then of havving selected my resource group in that TV ??
4. i want for module "gallery" grant usage to admins only and hide it from moderators .. where i can do that

and another question
5. i understand what is Policy .. but why is there Acces Policies and Policy Templates ?? i’m confused with that

another question...

one user group has acces policy "resource" and he couldn’t publish / upublish resources .. so i duplicated administrator policy and opened resource policy .. i wanted first to remove all checkobxes from admin policy so it will match resources policy .. and then just add some more to have more rights .. but i couldn’t find those checkoxes from resource policy in adin policy ??
isn’t resource just like administator but with fewer rights ?? ...

another question...

one user group has acces policy "resource" and he couldn’t publish / upublish resources .. so i duplicated administrator policy and opened resource policy .. i wanted first to remove all checkobxes from admin policy so it will match resources policy .. and then just add some more to have more rights .. but i couldn’t find those checkoxes from resource policy in adin policy ??
isn’t resource just like administator but with fewer rights ?? ...

1. Logged-in Manager users are anonymous in the front end *if they visit from another browser* -- When previewing the front end from the manager, you get special status so you can see pages you are working on, even if they’re not published, for example.

2. MODx’s general approach to security is that if any rule gives you access to something, you have access to it. Imagine an apartment with many keys to the front door. Five people refuse to give you the key, but the sixth person gives it to you. You get in.

3. I don’t understand the question.

4. Put the gallery plugin in a category, or (probably better) simply hide that menu choice with a custom permission in System -> Actions.

4+. No, the resource policy is completely different from the Administrator policy. They have different purposes and different permissions. http://bobsguides.com/revolution-permissions.html

Can we slow down on the multiple questions? This is making me dizzy.

1. and 2. ... thanx i understand now

3. when you create a TV, under "access permission" tab you can select a resource group, the same way you can do with each resource. I wanted to hide one TV so moderators won’t be able to view or edit that TV ... so for that TV i checked "developer" group in acces permissions tab but nothing happened .... for any resource where i set "developer" group is hidden ... why this doesn’t work for TV too ?? .. well my question is .. how to prevent some users to view/edit a TV?

... someone can explain me Access Policies vs. Policy Templates

Ah. I see. What you’ve done protects the TV object itself, so users won’t see it in the tree and can’t edit it, set its default value, change its type, etc.

It doesn’t affect whether the TV shows up when editing a resource. To hide it there, you need to use a Form Customization rule: http://rtfm.modx.com/display/revolution20/Form+Customization+Rules

thanx for explanation.... another thing to learn... form costumization

But first i have to figure out permissions ...

Anyone can explain me what are those Policy templates? .... and what Access policies ... ??

Those are the easiest part of permissions.

A policy is just a list of permissions determining what a person can do. If the permissions is checked, the person can perform that operation in places where the policy is applied (that’s the harder part).

A policy template just sets the possible permissions that will appear on the policy. It’s really a convenience feature so that you can just check or uncheck permissions rather then manually adding them and removing them from a policy as you had to do before. It also keeps users from accidentally removing permissions from a policy and not knowing how to put them back.

So basically, when you say "base this policy on that policy template" you’re just determining what permissions will be shown on that policy with their checkboxes.