Category read/write permissions system

[julianlam]

Expanding on #148 (wow, are we really at 500+ issues already...):

Categories will be the first to be "limited":

• Whitelist only, default is r/w all
• If a group is added to "read", they can enter and browse posts, but cannot post new topics (or reply to existing topics)
• If a group is added to "write", they can create new topics (and reply to existing topics). They are also automatically added to "read"
• If more than zero groups are in "read", the category becomes inaccessible to everybody except those in the whitelist

[julianlam]

@diasdavid

[cnvo]

​+1​

On Wed, Nov 27, 2013 at 8:13 AM, Julian Lam notifications@github.comwrote:

@diasdavid https://github.com/diasdavid

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/565#issuecomment-29383125
.

[julianlam]

phew

4d2469b
4855131
5ee5c81
f0e8633
df2e9b4

[julianlam]

It could use a great deal of debugging, but the bulk of the work is done fingers crossed

You can access the new category admin in the "categories" tab in the ACP, and note the new "Permissions" button.

Admins can read and write in all topics, of course, and once a whitelist contains a user, it is essentially private (except to that user).

To Do

• Hide system groups from the Groups page
• Make sure that forums aren't accidentally locked off to everybody if a category whitelist contains no users, but still exists
• Double-check that if a user has write, they also have read

[cnvo]

Jeeze, it's time to take a short break, enjoy your Thanksgiving Julian and
excellent work as always! I would call this quite a milestone as well. +1

On Wed, Nov 27, 2013 at 4:30 PM, Julian Lam notifications@github.comwrote:

It could use a great deal of debugging, but the bulk of the work is done fingers
crossed

You can access the new category admin in the "categories" tab in the ACP,
and note the new "Permissions" button.

Admins can read and write in all topics, of course, and once a whitelist
contains a user, it is essentially private (except to that user).
To Do

• Hide system groups from the Groups page
• Make sure that forums aren't accidentally locked off to _everybody_if a category whitelist contains no users, but still exists

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/565#issuecomment-29421741
.

[julianlam]

Hahha, thanksgiving? No thanksgiving here in Canada, already past!

[psychobunny]

haha in that case, happy thanksgiving @cnvo and to the rest of our US friends!

http://try.nodebb.org/topic/237/happy-thanksgiving

[seti123]

I created new user and added it to a group and gave permissions "Read" for that group to the board Announcements. Logout, Login with new user. The board was readable as expected, but it was also possible to create a new topic. This is a BUG. Just checked with latest version (made before git pull)

[julianlam]

@seti123 Can you check if this is still an issue on latest build, and if so, open a new issue? Thanks.

[seti123]

Thx. I can check tomorrow.

[seti123]

I made today a check. My group "customers" has only read permissions to "Announcements", the user customer1 is in group customer. Still the "New Topic" button is visible (which should not in my opinion...). But when creating new post and push submit nodeBB crashes (see message at the end). I repeated it several times, posting with admin user works (has write permission). First I thought it might be a problem of my REDIS installation but I fixed it before, and other posts and changes did work. Here comes the crash message:

info: NodeBB Ready

/disk2/nodebb/nodebb/node_modules/redis/index.js:535
throw err;
^
ReferenceError: socket is not defined
at /disk2/nodebb/nodebb/src/socket.io/topics.js:28:5
at /disk2/nodebb/nodebb/src/topics.js:75:12
at /disk2/nodebb/nodebb/src/categoryTools.js:97:3
at /disk2/nodebb/nodebb/node_modules/async/lib/async.js:530:17
at /disk2/nodebb/nodebb/node_modules/async/lib/async.js:116:25
at /disk2/nodebb/nodebb/node_modules/async/lib/async.js:24:16
at /disk2/nodebb/nodebb/node_modules/async/lib/async.js:527:21
at /disk2/nodebb/nodebb/node_modules/async/lib/async.js:530:17
at /disk2/nodebb/nodebb/node_modules/async/lib/async.js:116:25
at /disk2/nodebb/nodebb/node_modules/async/lib/async.js:24:16

[julianlam]

That looks like an unrelated bug. Can you please paste that error log as a
new issue?
On Jan 14, 2014 7:07 AM, "seti123" notifications@github.com wrote:

I made today a check. My group "customers" has only read permissions to
"Announcements", the user customer1 is in group customer. Still the "New
Topic" button is visible (which should not in my opinion...). But when
creating new post and push submit nodeBB crashes (see message at the end).
I repeated it several times, posting with admin user works (has write
permission). First I thought it might be a problem of my REDIS installation
but I fixed it before, and other posts and changes did work. Here comes the
crash message:

info: NodeBB Ready

/disk2/nodebb/nodebb/node_modules/redis/index.js:535
throw err;
^
ReferenceError: socket is not defined
at /disk2/nodebb/nodebb/src/socket.io/topics.js:28:5
at /disk2/nodebb/nodebb/src/topics.js:75:12
at /disk2/nodebb/nodebb/src/categoryTools.js:97:3
at /disk2/nodebb/nodebb/node_modules/async/lib/async.js:530:17
at /disk2/nodebb/nodebb/node_modules/async/lib/async.js:116:25
at /disk2/nodebb/nodebb/node_modules/async/lib/async.js:24:16
at /disk2/nodebb/nodebb/node_modules/async/lib/async.js:527:21
at /disk2/nodebb/nodebb/node_modules/async/lib/async.js:530:17
at /disk2/nodebb/nodebb/node_modules/async/lib/async.js:116:25
at /disk2/nodebb/nodebb/node_modules/async/lib/async.js:24:16

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/565#issuecomment-32259403
.

[barisusakli]

@seti123 the crash is fixed in 07085f1

[julianlam]

Thanks @barisusakli

[seti123]

Thx quick fix! Now it don't crashes and gives an accurate message "Unable to post You do not have posting privileges in this category." That's absolutely OK.
Beside the fact that it might be a bit annoying to the users to get this after writing a post (because the user can't recognize that he can't post to it) - I still think it would be nice to hide the "New Topic" button, when permission is not sufficient.

[barisusakli]

agreed

[olivierlambert]

Hi!

Is this feature will be released in a 0.6.2 soon?

Keep up the good work! 👍

[julianlam]

This feature is already completed

[olivierlambert]

Oh sorry. I probably miss it. I think I've got a bug, or I misunderstood the thing: I would like to create a category limited to a certain group (not visible for others). Is it in "Category Permissions"? If yes, I can't find/see any users nor any existing groups.