Element Category Access question

I’m trying to figure out how this works.

It works fine for simply hiding elements, but even though there is a policy attached to each ACL entry here, the effect is confusing.

I’m basing the policy on the standard Resource policy (though I’ve filed a suggestion in Jira to add a standard Element policy).

If I remove the "save" permission, the users can still save elements in the category because they have "save" and "save_chunks" in the admin policy in the mgr Context Access ACL. If I remove them from the Admin policy, and add them both to the policy attached to the Category Access ACL, the user can edit a chunk in the category, but gets "Permission Denied" when he tries to save it.

I haven’t tried this with resources yet, just elements.

So, do the permissions in the Category Access ACL policy have any effect at all? Are they intended to? Or am I just confused?

<?php
$object->checkPolicy(array('permission' => true, 'another_permission' => true));
?>

(now my brain hurts)

in the Administrator Policy attached to the mgr Context Access ACL entry for a user:

-- The user has "save" but not "save_chunks" -- can he save chunks?
-- The user has "save_chunks" but not "save" -- can he save chunks?

Now, add in the Element Category ACL with the chunks in the named category (it’s the only category):

-- The user has "save" and "save_chunks" in the Administrator Policy attached to the mgr Context Access ACL entry, but not in the Resource policy attached to the Element Category ACL - can he save chunks in the category?

-- Reverse the above -- can he save chunks in the category?

If a user has both a mgr Context Access ACL entry and a web Context Access ACL entry (necessary to see resources in that context in the tree), will the permissions in the *web* ACL entry affect what the user can do in the Manager with resources in that context (e.g. edit, save)? IOW, if the user has "save" and "save_chunks" in the web ACL entry but not in the mgr ACL entry:

-- Can he save chunks in the web context in the manager?

-- If he doesn’t have those permissions in the category, can he save chunks in the category?

-- Can he save chunks *not* in a category?

Re the Read, Read-Write, Read-Write-Remove idea, would the current specific permissions (save, save_chunks, view_snippets, etc.) be removed from the standard policies? If added back in, would they override? I.e. if a user had just "Read" permission, would adding save_chunks to the policy allow the user to save chunks? I think I like the idea.

Quote from: BobRay at May 31, 2010, 01:34 PM

Now, add in the Element Category ACL with the chunks in the named category (it’s the only category):

-- The user has "save" and "save_chunks" in the Administrator Policy attached to the mgr Context Access ACL entry, but not in the Resource policy attached to the Element Category ACL - can he save chunks in the category?

First, Resource policy? Create a policy for your Element Categories. Regardless it depends on what is in the policy attached to the Category. Does it have load and save? If so, then yes, he can load and save both the modCategory object and the modChunk (derivative of modElement). In this case, the load/save/remove core permissions apply to both the Category objects and the Element objects they are related to. In addition, policies are inherited from parent Categories, which also must be take into consideration.

The short answer is yes, if you attached the default Resource policy, he can save chunks in the category.

If a category is protected by at least one ACL entry, then he if he doesn’t have save on the category (or a parent category) then he will not be able to save chunks in the category (unless he is a member of the User Group attached to that ACL entry.

Re the Read, Read-Write, Read-Write-Remove idea, would the current specific permissions (save, save_chunks, view_snippets, etc.) be removed from the standard policies? If added back in, would they override? I.e. if a user had just "Read" permission, would adding save_chunks to the policy allow the user to save chunks? I think I like the idea.

This is more to differentiate between object permissions and content management permissions, which I think is where most of the confusion comes in. If we take Context ACLs out of the equation, all we are talking about is object permissions, or permissions that apply to specific instances of an object. Though these can also apply to Contexts, Contexts also define an entirely different set of permissions that define what core content management activities can be performed from that Context. So instead of load/save/remove for Contexts being defined in your default Administration policy, they would be defined and applied separately as a Read, Read/Write or Read/Write/Remove policy. This would isolate the permissions based on how they apply and avoid any confusion about a Context ACL save permission having anything to do with saving anything other than the Context object itself.

Let me also get clarification on the interaction of permissions in Context Access ACLs and Category Access ACLs. My understanding is that a Context Access ACL gives you permission to do stuff with unprotected objects. For protected objects, you need permission in both the Context Access ACL *plus* the Category or Resource Group ACL. Is that right?

Quote from: BobRay at Jun 01, 2010, 11:47 PM

Let me also get clarification on the interaction of permissions in Context Access ACLs and Category Access ACLs. My understanding is that a Context Access ACL gives you permission to do stuff with unprotected objects. For protected objects, you need permission in both the Context Access ACL *plus* the Category or Resource Group ACL. Is that right?

No; the Context Access ACLs control two different things, the Context object permissions (what Contexts they are allowed to load/save/remove), and the Context action permissions (i.e. what content management actions they can perform from those contexts). The load/save/remove in a Context ACL have no effect on loading/saving/removing of other objects like Resources or Elements.

I understood you earlier to say that a user who had save rights to an Element Category couldn’t save chunks without also having save_chunks permission in the Context Access ACL for the mgr context. This seems to contradict what you say here about Context ACLs having no effect on saving elements, or is this the difference between load and load_chunks? load has no effect, but load_chunks does? If so, it seems potentially confusing to have permissions with different scopes (or at least different targets) in the same policy.