Access Control Rules Clarifications

CSIPiemonte

Hi,
we need to configure the access control rules so that
the access with value 3 is given also to the group to which it belongs the object as well as to the user that has created,
as default behavior without necessarily having to go through exceptions
on the screen of access a new object.

new object
ca_acl
user 3, group 3, admin 3, all others 0

Can it be done from app.conf with the various access control rules?
Thanks

monica

I am not sure what you mean by 'access with value 3'?

CSIPiemonte

HI,
if I didn't misunderstand,
when a user creates a new object,
a new row is inserted on the ca_acl table with access = 3 which means CA_ACL_EDIT_DELETE_ACCESS and
user_id = who created the object.

However, I don't see the row on the ca_acl for the group the user belongs to,
this means that a user of the same group cannot see, edit and delete the object (if I understand).

Instead, I need all users of the same group to be able to act on the object, obviously in addition to the administrator
who must see and act on all objects regardless of group.
Can this be done with the access rules present in app.conf?

monica

A user can be part of more than one group and they can be added to groups by other people through the use of the 'my project teams'. Automatically enabled access to every user in the same group as a user that created the object would be hard to keep track of.

in app.conf you can set what the default permissions of an object is for everyone 'No access, Read Only and Read/Edit access.', but nothing else. The person who creates the object will need to go into the access and add the group or roles that are allowed to access that object manually.

CSIPiemonte

Thanks Monica, now the behavior of access management is clearer.

"The person who creates the object will need to go into the access and add the group or roles that are allowed to access that object manually."

If I wanted to manage the group's access in an automated way to obtain the behavior described above,
what do you recommend doing? plugin, prepopulate, insert in sql?

Our need would be to make objects accessible by group.

monica

I don't think it can be done with a prepopulate. I would use a plugin with the SaveItem or BeforeSaveItem hooks. https://manual.collectiveaccess.org/providence/developer/app_plugins.html#editing-providence-editors

Add the group and user as exceptions to the item access control

CSIPiemonte

monica thanks!

"Add the group and user as exceptions to the item access control"
How can we do this using code already present in CA without making direct queries on the db?
It's important for us to use CA core as much as possible to stay compatible.

Thanks in advance.