Can't have admin-only categories

[RoiEXLab]

NodeBB 1.7.5
Not sure if I missed something, but it seems like there's no way to have a category set to read only.
What I tried: On the permission management page adding admin and global moderator as a group and removing all checkmarks for global moderators.

1. The admin group doesn't show up, can't be added, probably makes sense.
2. Once all permissions for global moderators are removed, the entry disappears and just the guest and registered-users groups remain with all checkmarks removed as well.
3. Leaving a single checkmark for global moderators at 'find category' doesn't seem to work, haven't tried this on my own, but I was told by someone who tried yesterday on the same server. Global moderators can still access the category.

[julianlam]

Hi @RoiEXLab -- administrators can never be barred from a category, so removing all privileges from a category will mean only administrators can see it, enter it, post, etc. Hope that helps!

[julianlam]

Nevermind, @barisusakli explained the issue you're having with Global Mods...

[julianlam]

Yes, this is a difficult bug to fix... 🤔 Global Mods have implicit access to all categories, much like administrators, they need access to all categories. We could remove this implicit access, but then you would have to explicitly manage global mod privileges via the privileges page, which on the other hand kind of doesn't make sense as well...

[RoiEXLab]

@julianlam The idea is that such a category would be used if a mod misused their rights for example to discuss if this Mod should lose their status.

[julianlam]

☝️ That's someone else's GitHub username, by the way 😄

[RoiEXLab]

Lol 😁

[pitaj]

#5736 might solve your problem, specifically the "Split up moderation permissions" and "Change global moderators to a default group with by default global moderation permissions" parts.

Then you could add the permissions for all categories but the one for admins only.

[General-Dru-Zod]

I just recently had a somewhat related issue. I wanted to make a category restricted to global moderators, but if I removed all checks, This group disappeared completely from the privileges setup page, if I left one check in say, create polls. It still allowed access to this group. However this is a default group and functions in a different way from new groups. As you will see below.

What I had to do was a bit hacky but functional. I created a new group for them, emptied the global moderator group (since it's a default group and functions ,undesirably for what ever reasons) and allowed them one check in create poll for the restricted categories. Which should be harmless I hope. And also keeps the privileges setup from disappearing.

Anyways now I have restricted access to certain categories for the that group.

[RoiEXLab]

To give this issue (and therefore #5736 as well) a higher priority:
If somebody chooses to go with the workaround that simply creates a dummy group that gets manual privileges, there are several limitations, like for example, but not limited to banning.
Banning is only possible for global mods and admins, not some random group that happens to have all important rights on all categories.

[nomisum]

I would love this as well. In our use case we want a certain group to be able to manage subordinate groups, but not see into specific categories. Like global moderators but with restricted access. I saw a plugin for denying global mods access to categories, but I wouldn't want to rely on that for sensitive data.