resource groups and nested directories

I have a directory structure with a "News" directory on the top level. Within News are 3 other directories:
- Blog
- Events
- Press

I am trying to set up a user group that has access to Blog and Events but not Press. I originally created a Resource Group and dragged the Blog and Events directories into it. I added the Resource Group to an "Editor" User Group I created.

When a user from this group logs into the manager they do not see anything in the directory tree. This is apparently because the parent News directory is not in the Resource Group.

I can modify the Resource Group to include the News directory. Editor users then see and have access to all sub-directories, including Press which needs to be restricted.

Is it possible to use resource Groups selectively for sub-directories?

Also, is there a proper method for giving Editor users access to add, modify and delete resources within the Blog directory but not let them modify the Blog container resource?

Did you also create a *Context* Access ACL entry for the Editor user group giving them access to the 'web' context? If not, that would explain why they can't see the resources in the tree.

I set up mgr and web under Context Access in the User Group. Each with a minimum role of "Editor - 10" and the Content Editor access policy.

Everything works fine when I have the parent directory in the Resource Group. But when I just add the sub-directories the only thing viewable in the resource tree for those users is the house icon with "web". No ability to expand it. Clicking on it shows the message "Error! Access denied."

This is MODX Rev 2.1.3 by the way.

That's most likely because the other subdirectories/files are not protected in any way. You need to put them in a separate resource group and link that group to the Administrator user group with a Resource Group Access ACL entry so those are protected. That should make them disappear for users not in the Administrator group.

If the Editors are in the Administrator user group, you could set the minimum role so that ACL entry doesn't apply to them, but I'd recommend taking them out of the group because that will give you more options for Form Customization.

Thanks Bob. I had set up an "AllPages" resource group with admin only access (basically I followed your tutorial for the initial setup).

I played some more and put the parent News directory in both the AllPages and News resource groups. I dragged Blog and Events to the News resource group and Press to the AllPages resource group. Editors now see a resource tree with just the News directory with Blog and Events underneath. I would prefer the resource tree to just show Blog and Events (with no parent directory) but I can live with it this way.

The issue is that Editor users can click on the parent News directory and edit it. Is there a way for me to prevent this?

Yes, the parent (News) directory needs to be in different resource group than the rest, with a Resource Group Access ACL entry using the 'Load Only' or 'Load, List, and View' policy (can't remember which one -- I think the latter). That will allow users to see it and see its children, but not edit it.

Excellent, that works great. That really helps me wrap my head around how to use resource groups. Thanks!

I'm glad it worked for you. Thanks for reporting back.