Permissions - How to make all resources editable but limit creation/deletion to contents of one container

1. An Editor User Group which the Editor is a member of (and so are you)


2. *All* resources on the site in the same Resource Group (let's call it AllDocs)


3. A Policy based on the Resource Policy Template (let's call it NoCreate) with the 'create' and 'delete' permissions unchecked (and probably 'duplicate' as well)


4. A Resource Group Access ACL entry connecting the AllDocs Resource Group to the Administrator User Group (which the Editor is *not* a member of) with a Policy of Resource


5. A Resource Group Access ACL entry connecting the AllDocs Resource Group to the Editor User Group with a Policy of NoCreate


6. A Resource Group containing only the Resources in the blog container (let's call it 'CreateOk')



7. A Resource Group Access ACL entry connecting the CreateOk Resource Group to the Editor User Group with a Policy of Resource

<?php
$blogContainerId = 12;  // change 12 to the ID of the blog container

if ($resource->get('parent') == $blogConainerId) {
    $resource->joinGroup('CreateOk');
}

...

My only question would be whether this would allow the Editor to create new docs under the Blog container. I think so, but I'm not sure. I think you would also need a plugin to assign new resources under the blog container to the 'CreateOK' Resource Group. It should be very simple and there may be an extra that does this already. If there are no other folders under the blog container, this would do it (connected to OnDocFormSave):

<!--?php
$blogContainerId = 12;  // change 12 to the ID of the blog container

if ($resource--->get('parent') == $blogConainerId) {
    $resource->joinGroup('CreateOk');
}