login and logout as API functions

I’m trying to find an easy way to cause a user to logout from a page link in the menu. I envisioned just creating a simple Logout snippet that called a common function for doing this, but I do not believe we have such a function. This logic seems to be dependent on the process flow of the current WebLogin snippet ( see /assets/snippets/weblogin/weblogin.processor.inc.php ). Does it not make sense to turn these processes into encapsulated functions to be called via the API?

That does indeed make sense, at least to me. It’s a pretty "core" function for both custom front-end apps and the manager, as is the account creation and managment tools. Raymond mentioned that the management/creation would be moving to the API... hopefully very soon!

Sounds like a good time to also consolidate accounts + add in session corrections for user/admin and multisites.

Yes it does sound that way in fact.

This would definitely be a very nice thing to have for both web and manager users. When I wrote the manager login snippet I had to copy almost all of the code from the login processor file. It would be great if I could just call login method. Actually, to go into more detail what I’d really like to see is a class that would contain every step of the authentication as a method (ie userExists, userBlocked, passwordsMatch, etc., and then a "quick login" method that would perform the whole process for you. I think that would give us both the the abilty for quick development and still the flexibility to get around blocking and other things if need be. Make sense?

While we’re on the subject (kind of) what are the plans for permissions changes? I think that permissions is one thing that needs a lot of work both from an API standpoint and a structural standpoint.

One thing that I would really like to see is to allow a user to have a specific roll within a specific user group. Ideally you’d even be able to have multiple roles for a specific document group.

For instance, Tom is a user manager and Dick is a content manager. Easy enough, but what if Harry is a user manager and a content manager, I’d rather assign him to both roles instead of having to give him is own role. But let’s take it a bit further and say we want Harry to have full create, edit and delete rights for the Support area of the site but we only want to give him edit rights in the other areas.

Quote from: aNoble at Aug 20, 2005, 08:32 PM

One thing that I would really like to see is to allow a user to have a specific roll within a specific user group. Ideally you’d even be able to have multiple roles for a specific document group.

Have you been listening in on conversations between Ryan and myself?

Quote from: infoclipper at Aug 20, 2005, 08:33 PM

Have you been listening in on conversations between Ryan and myself?

I figured there had to be plans to overhall the permissions, I just hadn’t seen them in the forum anywhere. It doesn’t take much to realize that the roles are just too limited. It’s always confused me that there is so much flexibility built into what you have access to (sometimes I think there’s too much flexibility) and yet there there is so little flexibility in defining what that access really is. I’ve come close to giving a user multiple accounts just so they can have different roles in different areas of the site.

Anyway, I’m glad to see you guys are one step ahead of me

Yep, you pretty much nailed what Ryan and I have been discussing:

User > Role > Group

In other words, you will pick any of the defined roles when assigning a user to a group.

Hi Jason,

Yes we will be moving the web login code into the API. Maybe something like loginWebUser, logoutWebUser and createWebUser. The create web user will also support user groups.

Adam, Travis,

Yes there are plans to allow you to add Roles to user Groups. This means that user Harry is a user manager and a content manager will inherit the roles of whichever group he belongs to. In addition to that you’ll be able to deny Harry access to specific roles. This means that if harry is denied access to Create User permission but belongs to a group or groups that allows such action, he will not be able to do so.

Are we looking at anything like phpGACL?