We need a broker api to let different access modules should play together.

Comments

wipeout_dude’s picture

Since it appears that Nodetype Access permissions are checked first it should be something like..

Nodetype Access -> Other access module = Access
eg.
view -> view = view
view -> denied = denied
denied -> N/A = denied

Of course if using another access module it really negates the need to have Nodetype Access in the first place..

Perhaps the answer is to have some integration with ACL or even to extend Nodetype Access to allow for per node controls but this is probably getting away from the initial design intention and essentially reinventing the wheel that Content Access has already covered..

Maybe its worth contacting the Content Access maintainers and see if there is a way to get the modules to work together natively.. If they added the ability for the Nodetype Access permissions to be updated automatically when changing the permissions through the content access interface that would work very well..

geek-merlin’s picture

the answer is simpler and more powerful: a broker gets all answers from access modules and glues them together.
it's up to the broker to "and", "or" or whatever.

geek-merlin’s picture

Status: Active » Postponed

Postponed until i find more spare time, funding or code ;-)

Robin Millette’s picture

I hope these couple of links can help you out:

Access Control Kit
The goal of Access Control Kit (ACK) is to provide a customizable system for controlling access to all kinds of things in a Drupal site: nodes, taxonomy terms, menu items, and more. It will give site builders the flexibility to define access based on whatever conditions make sense for the site, while still providing an easy-to-understand UI for security administrators and regular users.
Using multiple node access modules just got a lot easier, maybe (JUN 9, 2009 - so nothing new here)
Two new hooks were recently committed to HEAD that will give Drupal 7 unprecedented flexibility when it comes to managing multiple node access modules on one site. Up until now, enabling multiple node access modules usually leads to unwanted behavior, most often exhibited by access being granted unexpectedly. This is partially because Drupal ORs access grants, so that a user is granted access to a node so long as one node access module allows it to do so, regardless of the opinion of the other access modules. (Note: Since the node_access table is one of the less understood components of Drupal core, you may want to check out John VanDyk's Pro Drupal Development for a good introduction to how it works, but diving into api.drupal.org or an existing node access module's code is probably the best way to grok it.)
geek-merlin’s picture

Thank you! Really interesting.

A few notes:
* The second info is not relevant here as we deal with query-rewrite ("post grants" ;-) access control.
* The first link to the ACK module sounds really interesting.

A first vgrep through the sources tell, this is mainly about the use case of users gathering roles by context (think of moderation rights for a specific forum) (the module uses the term grants for this in a completely different sense than node grants.)

Although i will definitely check this out further, i did not find the "broker" idea there.

geek-merlin’s picture

Issue summary: View changes

corrected