Can't edit permissions for superuser role

[adrianbj]

Short description of the issue

If you remove permissions from the superuser role, they don't have any effect.

Expected behavior

Either the changes should be respected, or the permissions shouldn't be editable at all.

Actual behavior

If you remove permissions from the superuser role, they don't have any effect.

Optional: Suggestion for a possible fix

Not really a suggestion for a fix, but an explanation of why I think the changes (removal of permissions) should be respected. It would make setting up of limited superuser accounts easier. Say you wanted a someone to have field and template editing permission, but not user managements permission (user-admin), you could remove "user-admin" from the main superuser role, and then add it to a dedicated "user-admin" role. Does that make sense?

[szabeszg]

"... the permissions shouldn't be editable at all."
I "vote" for this :)

[LostKobrakai]

Me as well. I don't think it would be a good idea to "limit" the superuser role, as there are so many hardcoded "return early for superusers" cases in the core.

[szabeszg]

I do not know too much about the PW core's codebase yet, but conceptually the superuser should be able to change/configure "all things possible" in the admin. We have a powerful RBAC at our disposal which should be utilized when restrictions are needed. I mean instead of removing permission from the superuser a new role+user should be added, etc, etc...

[adrianbj]

I agree with both of you guys. The problem is that you can't give non-superusers access to add fields and templates. My thoughts on this are coming from this post: https://processwire.com/talk/topic/17138-set-specific-admin-user-permissions/?tab=comments#comment-150621

I thought my alternative approach might make this easier. I am thinking what the OP wants could be achieved with hooks, but having inbuilt permissions to enable these for non-superusers would be better.

[ryancramerdesign]

I agree the permissions shouldn't be editable at all. I guess I hadn't ever thought to edit the superuser role since technically nothing there is editable (unless you add some other fields to the role template). I've pushed a update that basically hides the permissions field and adds a note in there that explains why they aren't shown. Superuser is a special role that implies all permissions, like "su" (or root) on unix.

Regarding field and template editors, those are Process modules that are really intended only for superuser. Adjustments there can be destructive to the entire site, which is superuser-only territory.

[adrianbj]

I've pushed a update that basically hides the permissions field and adds a note in there that explains why they aren't shown

Thanks - that should be much nicer.

Regarding field and template editors, those are Process modules that are really intended only for superuser. Adjustments there can be destructive to the entire site, which is superuser-only territory.

I agree - I was just passing along what another PW user was looking to do :)

[klor]

Related:
https://processwire.com/talk/topic/17416-how-to-deny-super-users-access-to-setup-modules-and-roles-permissions/