Answered Complex access management issues

hello. its about revo.
i have a web project with every page available only after authorization. so there is only auth page to begin with.
i also have multiple resource groups, element groups and user groups.

everything worked fine with login and TV inheritance and stuff before i began to create resource groups and assign them to pages.

i couldnt just save TV values in documents any more. and inheritance got broken ofc.
i've managed to fix it: wiped all TVs and resource groups and then created it back again. but this time i made resource groups first and TVs after that. donnow why but it helped.

also being logged as admin i lost pages from res_groups in manager site tree. had to update permissions for administrator group - didnt think ill have to actually. its admin after all.

but the worst thing appeared for web users. with proper context, roles and res_groupes assigned to web user group - i got a mess on site. looks like permissions are lagging or not working correctly.
for example i have pages assigned to a group and this resource group is [u]not available for any user group. but everyone can see it. and vice-verse there are pages in another group assigned to different user groups - but noone can see it.
[/u]i was playing with it all day and the result was always unpredictable and appeared randomly time after time.

WHAT AM I DOING WRONG?
cache? permissions flush? whatever?
was digging RTFM but its so straight forward and obvious that hardly could help

btw i have the same functionality made in EVO - and it works well.
first i was amazed with revo functionality but now i dont find this x^10 features useful.

where can i find proper step-by-step to setup secured modx site?

like:
1. resource groups
2. user groups, resource access definition
3. TV and element goups
4. pages and stuff
...
PROFIT!


there should be a proper path because i couldnt apply security layer for a working site - everything just got broken.
being a big fan of modx for 5 years, today is the worst experience.
help please or i'll get fired

for example i have pages assigned to a group and this resource group is [u]not available for any user group. but everyone can see it. and vice-verse there are pages in another group assigned to different user groups - but noone can see it.

It's hard to tell from your description, but for one thing, it sounds like you may misunderstand the concept of how pages are protected. Assigning pages to a resource group does not protect them in any way. Everyone can see them if everywhere if that's all you do.

Resources are only protected in the Manager when you connect that resource group to a user group with a Resource Group Access ACL entry with a context of 'mgr'. Users outside that user group can't see the pages in the Manager.

Similaraly, they are only protected in the front end when you connect that resource group to a user group with a Resource Group Access ACL entry with a context of 'web'. Users outside that user group can't see the pages in the front end.


There's a lot more information here: http://bobsguides.com/revolution-permissions.html. There are also some beginning and advanced security tutorials (see the menu).


------------------------------------------------------------------------------------------
PLEASE, PLEASE specify the version of MODX you are using.
MODX info for everyone: http://bobsguides.com/modx.html