Permissions and TVs

I’ve been trying to create a situation where a user (in the user group "Editors") can view a particular TV, but can’t edit it.

In order to edit other TVs, the Editors user group has mgr access with a policy that includes view_tv, edit_tv and save_tv.

I put the restricted TV in a resource group and connected it with the Administrators group with a Context access ACL entry.

Now the Editor user can’t see it. Using a Form Customization rule for the user’s user group with tvVisible:1 doesn’t make it visible (which I kind of expected -- since the user shouldn’t have access to the TV at all).

I then added the user to the Administrators group, and added a Context Access ACL entry with a role that allows mgr access for the Editors user group and a policy that *doesn’t* have save_tv or edit_tv permissions but does have view_tv.

Now the TV is visible, but the user can edit and save it.

Is this just not possible, am I going about it in the wrong way, or is it a bug?

Since the TV’s resource group is tied to the Administrators user group, it would seem that the Editor user’s access to that resource group should be controlled by the policy set for him in the Administrators Context Access ACL entry, but it doesn’t appear to work that way.

I would say it’s an edge-case bug, so I’d file it in JIRA.

I fear we’ll run into a lot of these, as enabling Revo users to hide *any* field and edit *any* permission makes the UI crazy-complex to build. So assume it’s a bug - unless I close the ticket.

Are you talking about editing Template Variables or editing instances of Template Variables on a Resource? Big difference...

Quote from: OpenGeek at Mar 09, 2010, 10:26 AM

Are you talking about editing Template Variables or editing instances of Template Variables on a Resource? Big difference...

Instances on a specific resource. That’s where you would want to restrict a low-level user’s ability to see and change TVs.

The standard Resource policy has nothing related to TVs and I was wondering if adding some tv-related permissions there might make sense.

Quote from: BobRay at Mar 09, 2010, 01:45 PM

The standard Resource policy has nothing related to TVs and I was wondering if adding some tv-related permissions there might make sense.

No, these are not really Resource-based permissions and need to be defined from the Element. We will be adding Element ACLs in future versions to achieve this granularity using permissions, but doubtful for 2.0.0. Right now, Revo mimics Evo in that the only permissions applied to TVs is through Resource Groups (via Resource Group ACLs); i.e. assigning TVs to Resource Groups will prevent access to those TVs in the UI. There are no options, either they can load/view/edit the TVs in a particular Resource Group, or they can’t (and this goes for editing the actual TVs as well as the Resource instances). Also note, if you apply these Resource Group ACLs to the web or other front-end contexts, it will affect access to those TVs in the front-end.

Thanks. Is this more-or-less correct, then?

At present, what the user can do with any TV (e.g. view, save, or edit) when editing a resource in the Manager is defined by his or her most permissive mgr context policy in any user group he or she belongs to.

Quote from: BobRay at Mar 09, 2010, 02:08 PM

Thanks. Is this more-or-less correct, then?

At present, what the user can do with any TV (e.g. view, save, or edit) when editing a resource in the Manager is defined by his or her most permissive mgr context policy in any user group he or she belongs to.

No, Context policies do not affect "editing" Template Variable values for specific Resources at all. They only drive permissions to being able to view, edit, save, or delete actual Template Variable Elements themselves.

Quote from: OpenGeek at Mar 09, 2010, 04:14 PM

Quote from: BobRay at Mar 09, 2010, 02:08 PM

Thanks. Is this more-or-less correct, then?

At present, what the user can do with any TV (e.g. view, save, or edit) when editing a resource in the Manager is defined by his or her most permissive mgr context policy in any user group he or she belongs to.

No, Context policies do not affect "editing" Template Variable values for specific Resources at all. They only drive permissions to being able to view, edit, save, or delete actual Template Variable Elements themselves.

LOL. It actually *says* that in another part of my book. I should read it some time.