Assign edit roles to pages according to its template

[wheelmaker24]

Hi guys,

I've been thinking about the page editing permissions on our - hopefully soon to be released - intranet application that is based on ProcessWire. To explain the structure of our page: We've got

• an overall news section,
• country specific news sections,
• a social media section and of course
• static publishing pages

I've decided to divide the news sections from the pages, as content from those sections is not per se bound to the starting page but could also be displayed from other pages. We are using the following templates:

Dynamic content:

• content-news: the standard news template
• content-news-gallery: a gallery template
• content-news-video: a video template
• content-promotion: ads and promotions
• content-posting: social media content
• ...

Containers:

• container-news: contains content-news, content-news-gallery, content-news-video and content-promotion
• container-postings: contains content-posting
• ...

Pages:

• page-default: standard publishing pages
• page-section: page that displays items from containers via a selector text field (e.g. "parent=2051,-date")
• page-sections: page that has more than one sections

The starting page for example is a page-sections page that is divided in three sections displaying content from a) an overall container-news template, b) a container-postings template and c) country specific container-news templates. Each section has an archive page (page-section) that only shows content from the container chosen in the section.

(I will maybe post our approach as a case study, if anyone is interested)

But let's come to the permissions:

It would be great being able to add editors and publisher to specific pages. The user should then inherit the template's permissions, but still be restricted to the page he or she is assigned to.

• Example 1: I would like to add a user as an editor of the Austrian news section (container-news). With this the user should get the permissions to add children to the Austrian container-news page but also get edit permissions for their children (the allowed children are already defined within the template settings).
   
• Example 2: I would like to add a user as an editor of the Services page (page-default). He or she should then get the permission to edit the Service page and all of its children.

I was thinking it would be a good idea to add an editors and a publishers page field to each template that is linked to the user pages. But I'm not sure how to proceed from here. Ideally those to fields would appear within the "Settings" tab of each page.

If possible each "Settings" tab should also list the users that inherit access from parent pages. A page field with all the editable pages within a user template would be great (like in Ryan's "Page Edit Per User" module) -- although the primary use case will be the other way around (chosing users from pages, not pages for users).

Where should I start? Are there any hooks I can use that manage editing access? What do I need to consider from a security point of view?

Thanks!

Nik 

[adrian]

Sorry, no time for a detailed answer, but this might be helpful:

This hooks into the check for whether a page is editable. Currently it is preventing access (returning false) for any page with the "mytemplate" template. You could modify this to check for certain users/roles.

$this->addHookAfter('Page::editable', function($event) {
    if($event->object->template == "mytemplate") {
        $event->return = false;
    }
});

You might also find some useful code/ideas in these two modules:

http://modules.processwire.com/modules/admin-restrict-branch/

http://modules.processwire.com/modules/page-protector/

Hope that helps to get you going!