By: Gabriel Ambuehl
posted: Tuesday 27 December 2005
While the ezpublish permission system is quite flexible from an admin's point of view, it leaves a lot to be desired from an user's point of view. For example, a user can't decide himself (not easily, anyway) who should be able to read the object he just created. Even in the plain old Unix permission model he gets to chose that (obviously root can override that, but administrators are 1:1 the same in ezpublish) up to a certain extent.
Thus my desire to give this flexibility to users on an on off basis (obviously, in some cases you don't want to allow them this power, most likely when you're using approve workflows and things like that). After thinking about it for a while, I've decided that shoehorning a good model into the current permission system (like I did with ParentOwner which is comparably trivial) would be really really ugly and rather inflexible to boot. I then laid this to rest somewhere in the back of my mind until my interest in this got resparked when I read http://ez.no/community/forum/setup_design/make_robust_to_using_back_button_rather_than_cancel#msg90419 (the beginning of the discussion isn't quite related to this, but in the end it quickly converges towards this, in my mind anyway).
When I first thought of this I figured that using sections in a clever way would work (and most likely it would, for simple private/public features) but after some thinking I've decided against that. At some point it dawned upon me that a custom ACL datatype would be perfect for this, the only change in the kernel would then be a hack to recognize this datatype and let it override some of the permissions if it exists in an object!
Since the architecture is very flexible this way, I've been thinking that first I need to get the code stub to interface with the datatype into the kernel, after which the datatype can gradually be extended (obviously starting with a binary private/public option for reading, then writing, then adding something more like ACLs, possibly even groups).