Document access permissions ?

Quote from: BobRay at May 24, 2009, 05:13 PM

I think what would help me the most is to see a list of all the specific steps (with no steps combined) necessary to create users with specific rights.

Working on the documentation that will hopefully clarify the confusion over the new policy-oriented security system.

Quote from: BobRay at May 24, 2009, 05:13 PM

Is there a one-to-one correspondence between Roles and Authority numbers?

Not exactly; you can define multiple Roles with the same Authority if you so choose. Authority may mean different things within different User Groups.

Quote from: Thalion at May 30, 2009, 01:05 PM

I put Document A in Group B
When no user group is assigned to Group B -> Document A is visible in both contexts
When Group B linked to user Group C, with autority 0, Access Policy "Ressource" and Context : "Web" -> Document A is visible in manager, not in Web context (either when not logged or logged with a member of Group C)
If you leave the Context field empty, the document is no longer visible in manager as well.

The way I understand how permissions should work, it should be visible when you are logged with a member of group C ?

Only if the user in Group C has an Authority level (from their Role in the Group) less than or equal to the Authority defined in the User Group Access to Resource Group record you created. With an Authority of 0, the User must have a Role with an Authority of 0 for the Policy to apply to that user.

Also, permissions for the web context are completely separate from the permissions for the mgr context, and, you must log in to each context specifically (i.e. being logged into the mgr does not log you in to the web).

Quote from: Thalion at May 30, 2009, 01:05 PM

But I think I might have an idea as to where the problem might be :
I am also trying to use the MemberCheck snippet, and there are problems here as well :

MemberCheck needs to be re-engineered for Revolution. The check for context == mgr is irrelevent since it never runs in the mgr context. I’ll take a look when I get a chance and update this component.

Quote from: OpenGeek at May 30, 2009, 11:04 PM

Only if the user in Group C has an Authority level (from their Role in the Group) less than or equal to the Authority defined in the User Group Access to Resource Group record you created. With an Authority of 0, the User must have a Role with an Authority of 0 for the Policy to apply to that user.

Also, permissions for the web context are completely separate from the permissions for the mgr context, and, you must log in to each context specifically (i.e. being logged into the mgr does not log you in to the web).

When I talk about a user logged, of course, I mean logged in Web context (but you’re right, it’s better to say it precisely)

I did several tests with Authority, and still no luck.
Here is what I tried :
Doc A is placed in Group B
I create a policy "Hide" which is a duplicate of the "Ressource" policy with list and view set to false
I change Member Authority to 990
User C is a Member of group D
[table]
[tr][td]Group Anonymous, Policy Hide | [/td][td] Group D, Policy Ressource | [/td][td] Not logged | [/td][td] User C logged[/td][/tr]
[tr][td]9999[/td][td]9999[/td][td]Shown[/td][td]Shown[/td][/tr]
[tr][td]0[/td][td]9999[/td][td]Shown[/td][td]Shown[/td][/tr]
[tr][td]0[/td][td]0[/td][td]Hidden[/td][td]Hidden[/td][/tr]
[tr][td]9999[/td][td]0[/td][td]Hidden[/td][td]Hidden[/td][/tr]
[tr][td]0[/td][td]Not Set[/td][td]Hidden[/td][td]Hidden[/td][/tr]
[tr][td]9999[/td][td]Not Set[/td][td]Hidden[/td][td]Hidden[/td][/tr]
[tr][td]Not Set[/td][td]9999[/td][td]Shown[/td][td]Shown[/td][/tr]
[tr][td]Not Set[/td][td]0[/td][td]Hidden[/td][td]Hidden[/td][/tr]
[/table]
Numbers are the value I set for Authority for the corresponding rule, always with context set to "Web"
Not set means that there wasn’t any rule
I did flush permissions after every change

I didn’t see any time where there was a difference between a user logged or not logged.

One small update :
In my error log, I found : (ERROR @ /index.php) No foreign key definition for parentClass: modUser using relation alias: modWebGroupMember
while trying to use the function isMemberOfWebGroup.
I was wondering why all results came "false", and I think this might be the reason why group membership doesn’t seem to work in the web context.

I think it has nothing to do with it, but while searching for errors, I also got the following warning :
8: A non well formed numeric value encountered
/core/xpdo/om/xpdoobject.class.php
932