On Thu, 8 May 2008, Schults, Chris wrote:
>> I think I'd hesitate to say it sucks. I really like
permissions in
>> Bricolage.
>
> I agree with Bret. What could be better is the
documentation, which is why 
> Phillip's video tutorials rock! Also, as David has
mentioned, how one defines 
> category permissions for user groups could be
improved.

I agree that the problems are mainly just ones of
improvement.
   You'll set the permissions for an "object"
within the system,
but the result of doing that is sometimes unintuitive,
because there's no real "hierarchy" of objects (no
way to specify
which permissions of which objects depend on the others),
other than what someone felt like putting into a Mason
component [1]
whenever they added a feature. For example, if I set READ
permissions
on a Category object, I personally would expect that
nothing
"belonging to" ("in", "under")
that Category would be EDITable.

(As a possible corollary of the above, [2]
it should (possibly) be possible to specify not just a
grouping of
permissions but a hierarchy of the objects with explicit
rules for
how the permissions are inherited.)


[1] which is another problem: the permissions are sometimes
embedded in the UI, c.f. `grep -r chk_authz comp`
(or `grep -r chk_authz lib/Bric/SOAP/`),
rather than integrated into the API.

[2] and as a parenthetical note, since I'm not volunteering
to implement
anything and I try to avoid suggesting things be done that
I'm not
volunteering to do.