Re: [Tiki-devel] Permission inheritance

Hi Jonny,

It sounds like you are trying to re-create 'Workspaces
https://doc.tiki.org/Workspace' with Categories?
Though, I most likely do not understand your full use case.

br,
Mike

On Tue, Feb 2, 2021 at 7:53 PM Jonny Bradley via TikiWiki-devel <
[email protected]> wrote:

> Hi all
>
> Well that grew into a bit of a monster task!
>
> Now pushed to trunk/master in
> https://gitlab.com/tikiwiki/tiki/-/commit/7b963065 - do you think you
> could take a look over it Victor (and anyone else fearless enough to
> venture into these areas) please? :)
>
> I need it in 22.x so am preparing a patch which i'll apply locally to a
> pre-production tiki so it should get some significant testing there, but if
> others could check in trunk before i backport for real that would be
> greatly reassuring!
>
> Basically, this fixes being able to set up permissions on a category, and
> be able to set that category on a file gallery, forum, blog or calendar,
> and the child objects inside them (files, threads, posts and events) will
> obey the perms set in their parent's category. Basically how it should have
> been forever, but wasn't ;)
>
> Many thanks to Victor again for doing the hard bit (several years ago), i
> just took the same theory used for tracker items and extended it a bit :p
>
> jonny
>
>
>
>
> > On 1 Feb 2021, at 14:41, Jonny Bradley via TikiWiki-devel <
> [email protected]> wrote:
> >
> > Thanks Victor, nice to hear :)
> >
> > I have a commit coming but added calendars and calendaritems, and blogs
> and blog posts to the category factory but need to set up test cases here
> locally to check i got the sql right...
> >
> > More soon
> >
> > jonny
> >
> >
> >
> >> On 1 Feb 2021, at 12:02, Victor Emanouilov via TikiWiki-devel <
> [email protected]> wrote:
> >>
> >> Hi Jonny,
> >>
> >> I think I'd have done it the same way! Looks good to me.
> >>
> >> File gallery->file relation actually works but only on object level
> (e.g. permission assigned to the file gallery will apply for all files
> under it and individual file permissions will apply for the files
> themselves). However, you are right that category factory needs more
> updates to make it happen - e.g. permission assigned to a file gallery via
> a category to be enforced for files underneath.
> >>
> >> Regards,
> >> Victor
> >>
> >> On 1/27/21 2:58 PM, Jonny Bradley via TikiWiki-devel wrote:
> >>> Hi Victor
> >>>
> >>> Thanks for the speedy reply 8)
> >>>
> >>> So to test i set all forum perms off globally and made a category (reg
> can see) that has all forum perms apart from tiki_p_admin_forum set for
> registered, and categorised a forum as "reg can see", and i can see the
> forum which should have the topics list, but none show up.
> >>>
> >>> I think i've got it working, but not going to commit it just now (new
> releases coming this afternoon!) but just in case you have a chance to look
> over this, here's the new patch (below).
> >>>
> >>> The main "magic" i was missing i think was the database lookup in
> CategoryFactory.php which i think i got working eventually.
> >>>
> >>> If this is all ok i'll commit it to trunk and test more before
> backporting, but then also i'd like to add files and file galleries support
> at least, because this has been a major "feature disappointment" since tiki
> 1.x :p
> >>>
> >>> Thanks V, catching up gradually! (wow, only 4 yours since
> https://gitlab.com/tikiwiki/tiki/-/commit/1ed83819 ;)
> >>>
> >>> jonny
> >>> ---
> >>>
> >>>
> >>> Index: lib/core/Perms/ResolverFactory/CategoryFactory.php
> >>> IDEA additional info:
> >>> Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
> >>> <+>UTF-8
> >>> ===================================================================
> >>> diff --git a/lib/core/Perms/ResolverFactory/CategoryFactory.php
> b/lib/core/Perms/ResolverFactory/CategoryFactory.php
> >>> --- a/lib/core/Perms/ResolverFactory/CategoryFactory.php    (revision
> 5459652a28dd0edae95e16c103920985aa2c9d14)
> >>> +++ b/lib/core/Perms/ResolverFactory/CategoryFactory.php    (date
> 1611751776236)
> >>> @@ -88,7 +88,7 @@
> >>>             }
> >>>             // only trackeritem parents supported for now
> >>> -           if ($this->parent && $baseContext['type'] !==
> 'trackeritem') {
> >>> +           if ($this->parent && ! in_array($baseContext['type'],
> ['trackeritem', 'thread'])) {
> >>>                     return $values;
> >>>             }
> >>> @@ -155,6 +155,15 @@
> >>>                             INNER JOIN `tiki_category_objects` co ON
> co.`catObjectId` = o.`objectId` WHERE " .
> >>>                             $db->in('ti.itemId', array_keys($objects),
> $bindvars) . " ORDER BY co.`catObjectId`, co.`categId`",
> >>>                             $bindvars
> >>> +                   );
> >>> +           } else if ($baseContext['type'] === 'thread' &&
> $this->parent) {
> >>> +                   $bindvars = [];
> >>> +                   $result = $db->fetchAll(
> >>> +                           "SELECT co.`categId`, comm.`threadId` AS
> itemId FROM `tiki_comments` comm
> >>> +                           INNER JOIN `tiki_objects` o ON
> comm.`object` = o.`itemId` AND o.`type` = 'forum'
> >>> +                           INNER JOIN `tiki_category_objects` co ON
> co.`catObjectId` = o.`objectId` WHERE " .
> >>> +                           $db->in('comm.threadId',
> array_keys($objects), $bindvars) . " ORDER BY co.`catObjectId`,
> co.`categId`",
> >>> +                           $bindvars
> >>>                     );
> >>>             } else {
> >>>                     $bindvars = [$baseContext['type']];
> >>> Index: tiki-view_forum_thread.php
> >>> IDEA additional info:
> >>> Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
> >>> <+>UTF-8
> >>> ===================================================================
> >>> diff --git a/tiki-view_forum_thread.php b/tiki-view_forum_thread.php
> >>> --- a/tiki-view_forum_thread.php    (revision
> 5459652a28dd0edae95e16c103920985aa2c9d14)
> >>> +++ b/tiki-view_forum_thread.php    (date 1611751776287)
> >>> @@ -145,7 +145,7 @@
> >>> $commentslib->comment_add_hit($_REQUEST["comments_parentId"]);
> >>> $commentslib->mark_comment($user, $forumId,
> $_REQUEST["comments_parentId"]);
> >>> -$tikilib->get_perm_object($_REQUEST['comments_parentId'], 'thread');
> >>> +$tikilib->get_perm_object($_REQUEST['comments_parentId'], 'thread',
> '', true, $forumId);
> >>>   if ($user) {
> >>>     if ($forum_info["moderator"] == $user) {
> >>> Index: lib/tikilib.php
> >>> IDEA additional info:
> >>> Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
> >>> <+>UTF-8
> >>> ===================================================================
> >>> diff --git a/lib/tikilib.php b/lib/tikilib.php
> >>> --- a/lib/tikilib.php       (revision
> 5459652a28dd0edae95e16c103920985aa2c9d14)
> >>> +++ b/lib/tikilib.php       (date 1611751776275)
> >>> @@ -4054,13 +4054,13 @@
> >>>      * @param bool $global
> >>>      * @return array|bool
> >>>      */
> >>> -   function get_perm_object($objectId, $objectType, $info = '',
> $global = true)
> >>> +   function get_perm_object($objectId, $objectType, $info = '',
> $global = true, $parentId = null)
> >>>     {
> >>>             global $user;
> >>>             $smarty = TikiLib::lib('smarty');
> >>>             $userlib = TikiLib::lib('user');
> >>> -           $perms = Perms::get([ 'type' => $objectType, 'object' =>
> $objectId ]);
> >>> +           $perms = Perms::get([ 'type' => $objectType, 'object' =>
> $objectId, 'parentId' => $parentId ]);
> >>>             if (empty($perms->getGroups())) {
> >>>                     $perms->setGroups($this->get_user_groups($user));
> >>>             }
> >>> Index: lib/comments/commentslib.php
> >>> IDEA additional info:
> >>> Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
> >>> <+>UTF-8
> >>> ===================================================================
> >>> diff --git a/lib/comments/commentslib.php
> b/lib/comments/commentslib.php
> >>> --- a/lib/comments/commentslib.php  (revision
> 5459652a28dd0edae95e16c103920985aa2c9d14)
> >>> +++ b/lib/comments/commentslib.php  (date 1611751776224)
> >>> @@ -915,7 +915,7 @@
> >>>             $query .= $info['query'];
> >>>             $ret = $this->fetchAll($query, $info['bindvars'], $max,
> $offset);
> >>> -           $ret = $this->filter_topic_perms($ret);
> >>> +           $ret = $this->filter_topic_perms($ret, $forumId);
> >>>             foreach ($ret as &$res) {
> >>>                     $tid = $res['threadId'];
> >>> @@ -954,17 +954,17 @@
> >>>             return $this->getOne($query, $info['bindvars']);
> >>>     }
> >>> -   private function filter_topic_perms($topics) {
> >>> +   private function filter_topic_perms($topics, $forumId = null) {
> >>>             $topic_ids = array_map(function($row){
> >>>                     return $row['parentId'] > 0 ? $row['parentId'] :
> $row['threadId'];
> >>>             }, $topics);
> >>>             $topic_ids = array_unique($topic_ids);
> >>> -           Perms::bulk(['type' => 'thread'], 'object', $topic_ids);
> >>> +           Perms::bulk(['type' => 'thread', 'parentId' => $forumId],
> 'object', $topic_ids);
> >>>             $ret = [];
> >>>             foreach ($topics as $row) {
> >>>                     $topic_id = $row['parentId'] > 0 ?
> $row['parentId'] : $row['threadId'];
> >>> -                   $perms = Perms::get(['type' => 'thread', 'object'
> => $topic_id]);
> >>> +                   $perms = Perms::get(['type' => 'thread', 'object'
> => $topic_id, 'parentId' => $forumId]);
> >>>                     if ($perms->forum_read) {
> >>>                             $ret[] = $row;
> >>>                     }
> >>>
> >>>
> >>>
> >>>> On 27 Jan 2021, at 09:26, Victor Emanouilov via TikiWiki-devel <
> [email protected]> wrote:
> >>>>
> >>>> Hi Jonny,
> >>>>
> >>>> Does this comment in Perms_ResolverFactory_CategoryFactory help?
> >>>>
> >>>> * Parent parameter can be passed during initialization to configure
> >>>> * Factory to return parent object permissions. Currently only supports
> >>>> * TrackerItem parents (i.e. Trackers) category permissions. Parent
> >>>> * perissions are retrieved by loading categories for the parent and
> then
> >>>> * checking their permissions.
> >>>>
> >>>> If you use category permissions, maybe that's why parent->child
> inheritance does not work in forum context. For now parent->child
> permission check on category basis is done only for tracker->trackeritem
> relation. We could extend to forum->thread level but I am not use both of
> these can be categorized. Can you share a bit more about your use-case -
> where do you set categories and which categories get permissions?
> >>>>
> >>>> Regards,
> >>>> Victor
> >>>>
> >>>> On 1/27/21 11:11 AM, Jonny Bradley via TikiWiki-devel wrote:
> >>>>> Hi all, almost certainly something for Victor but others may know
> and/or benefit from sharing :)
> >>>>>
> >>>>> A couple of Tikis ago you added a "layer" to the Permissions system
> so that child objects could inherit the permission on their parents, like
> files in file galleries, and blog posts in blogs etc.
> >>>>>
> >>>>> We are deploying a tiki for a client that needs category permissions
> to work on forums, which we assumed they would but it seems not. A user can
> see how many "topics" (a.k.a. threads) there are in a forum, on
> tiki-forums.php, but not see the actual posts in tiki-view_forum.php or
> tiki-view_forum_thread.php.
> >>>>>
> >>>>> So i worked out the patch below, which gets the relevant parent
> forumId into the Perms::get function and hoped the Victor Magic would take
> over and all would be well... but it seems not. And stepping through the
> code i get lost, as usual, in \Perms_ResolverFactory_ObjectFactory::bulk
> and so on.
> >>>>>
> >>>>> What did i miss?
> >>>>>
> >>>>> Thanks in advance
> >>>>>
> >>>>> jonny
> >>>>> ----
> >>> [snip]
> >>>
> >>> _______________________________________________
> >>> TikiWiki-devel mailing list
> >>> [email protected]
> >>> https://lists.sourceforge.net/lists/listinfo/tikiwiki-devel
> >>
> >>
> >> _______________________________________________
> >> TikiWiki-devel mailing list
> >> [email protected]
> >> https://lists.sourceforge.net/lists/listinfo/tikiwiki-devel
> >>
> >
> >
> >
> > _______________________________________________
> > TikiWiki-devel mailing list
> > [email protected]
> > https://lists.sourceforge.net/lists/listinfo/tikiwiki-devel
> >
>
>
>
> _______________________________________________
> TikiWiki-devel mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/tikiwiki-devel
>

_______________________________________________
TikiWiki-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-devel