Document Groups Question

I am trying to setup a site where different editors have manager access to selected sections of the site. In order to accomplish this I need to setup a manager document group and select the documents to be added and add them by selecting the checkbox next to the document group. However when logged in as an editor role (not admin role) user I can still see and and edit all the other documents that are not part of the desired doc group. Obviously all the other docs are set to public that is why I can edit them. So I guess that I need to have every other document assigned to some manager group in order to be able to isolate the docs I need. Am I correct? So I have to make all the docs not public in order to control them in the manager side. This is very confusing since all the files are to be public in the front end but if you look at it it seems that they will not be public in the front end..

If you don’t put documents in a document group and assign access to a manager user group, they will certainly be editable by all manager users. So, yes, you would need to put any documents you exclusively don’t want any group member to edit in a document group themselves. We know it’s not the optimum security model for every need, and we are researching ways to support a variety of common security models in upcoming releases, but for now, that’s how it works.

Thanks for the confirmation. In retrospect it is a good idea to plan your document groups ahead of time. No problem. What I do find confusing is that the web and manager groups are together in the same section in the document settings. A solution would be to isolate the web doc group selectors from the manager group doc selectors. This might make it more clear. I am now using naming prefixes to identify the web from manager groups, mGroupName and wGroupName.

To illustrate my suggestion see the attached jpg.

Those are Document groups, and they are not differentiated between web and manager. They are just ways to group your documents. You assign web or manager user groups to grant access permissions to certain document groups.

Those are Document groups, and they are not differentiated between web and manager.

Ok, I see... sorta. SO the document group has nothing to do with the permissions, roles handle the permissions. Regardless of the user type I can assign them to the same document group and MODx will let them do whatever according to the role and user type.

As you can see I am a bit confused, most likely over thinking it. I am sure that this will all make sense once I get more experience with the concept. There are plenty of docs, and I am sure I have gone through all of them and still am a bit confused. No stress, I am sure I will get it right eventually, I am having a bit of a brain overload lately so as soon as I can look at this with some calmness I am confident that it will sink in. I am sure that if this has worked so far for so many people than it should work fine for me as well

Just to see if I have the correct idea: I have a website where there are around 40 contributors who need to be able to manage only their own pages. So in order to do this I need to; 1) setup a manager user for each contributor, 2) setup a document group for each contributor, and then 3) assign each document to the correct document group. Then in order to isolate all the remaining public pages I need to assign those to a document group as well. Does that sound right?

Quote from: dev_cw at Nov 19, 2007, 08:45 AM

Just to see if I have the correct idea: I have a website where there are around 40 contributors who need to be able to manage only their own pages. So in order to do this I need to; 1) setup a manager user for each contributor, 2) setup a document group for each contributor, and then 3) assign each document to the correct document group. Then in order to isolate all the remaining public pages I need to assign those to a document group as well. Does that sound right?

Almost, you just are forgetting the steps to assign a manager user to the manager user group, and the manager user group to a document group.

Also, what you are describing is difficult to implement in the current security model, as I tried to explain, since having a user and document group for each user is going to be required, and to prevent them from editing the documents that are not assigned to any other document group will require it’s own document group, which you (or other admins with access to edit those pages) would have to be associated with through another user group.

Also, what you are describing is difficult to implement in the current security model, as I tried to explain, since having a user and document group for each user is going to be required, and to prevent them from editing the documents that are not assigned to any other document group will require it’s own document group, which you (or other admins with access to edit those pages) would have to be associated with through another user group.

Seems like a lot of work, but if this is the way it has to be then this is the way it will be since we require this sort of setup. Thanks for the help.

I may be way off base here, but since documents have an owner, wouldn’t it be possible in future versions of MODx to have an option (or perhaps a special kind of role) that allowed manager users to see/edit only documents that they "own"?

Could this be implemented in current versions with a plugin?

It seems that many users need something similar.

Bob

Quote from: BobRay at Nov 19, 2007, 05:54 PM

Could this be implemented in current versions with a plugin?

Answer is yes it could be done using the OnDocFormPrerender plugin event. And it might be a good one to make (you’ll notice there’s no documentation on the wiki, which is also needed...)

I have no need for this type of functionality so other projects will take priority over this, but I’ll look into it when I have the time. I’d be more than happy to advise or even finish code that someone else has done related to this.