page-unpublish permission?

[valan]

How to assign a permission (to the role) that allows only published pages (of some template) editing AND does not allow editing of unpublished pages? E.g. I want to disable pub/unpub action button both in tree and in Listers for some role/template, but leave editing.

[kixe]

Unfortunately this is not possible with built in permissions. Only the other way round is possible. You can add some permissions manually which are known by PW.

1. page-publish: Publish/unpublish pages or edit already published pages. When installed, editable() returns false, when it would otherwise return true, on published pages, if user doesn't have page-publish permission in their roles.
   
    
2. page-hide: Hide/unhide pages
3. page-edit-created: Edit only pages user has created
4. page-rename: Change the name of published pages they are allowed to edit
5. user-admin-all: Administer users in any role (except superuser)

Have a deeper look here:
https://processwire.com/api/user-access/permissions/#optional-core-permissions

[adrian]

I think you should be able to achieve what you want by hooking into Page::editable

I think this should do what you are looking for - just edit the template you want to match. Keep in mind that in this form it will even prevent superusers from editing the page, so you might want to check that before adding the hook

$this->addHookAfter('Page::editable', null, 'hookPageEditable');

function hookPageEditable($event) {

    $p = $event->object;

    // in case there is already a defined exclusion for this user's role for this page
    if(!$event->return) return;

    if($p->template->name == "basic-page" && $p->hasStatus(Page::statusUnpublished)) {
        $event->return = false;
    }
    else {
        $event->return = true;
    }
}

[adrian]

Actually I just realized I might have been a bit confused by what you want - I thought what I wrote answered the first sentence in your question, but the second sentence suggests you want to hide the pub/unpub action buttons, in which case try this in your ready.php

$this->addHookAfter('ProcessPageListActions::getExtraActions', null, 'hookGetExtraActions');

function hookGetExtraActions($event) {
    $page = $event->arguments[0];
    $extras = $event->return;

    if($page->template->name == "basic-page" && $page->hasStatus(Page::statusUnpublished)) {
        unset($extras["pub"]);
    }
    $event->return = $extras;
}

You can remove the page status check for unpublished and also add: 

unset($extras["unpub"]); 

if you want to remove that as well.

[valan]

@adrian thanks!

I've found one more solution that addresses own Q and does not require code. It is as simple as (1) setting "Don't allow unpublished pages" in template advanced settings and (2) adding role-publish permission in template access tab. As a result, there are no unpublished pages => no "pub/unpub" buttons while user in role is allowed to edit published pages.)