Ability to provide global member administration without global content administration

If a user has global "administer group" permission, og_user_access also gives her all content permissions that exist in a group.

But that's exactly the point of that permission, so I'm not clear about the issue.

> * we modeled some node-create permissions per language

In that case I think you should look at #1865944: Allow implementing modules to change the My/Other groups selection -- where the group-audience logic is custom.

(If you think differently please open the issue)

+++ b/og.moduleundefined
@@ -2057,6 +2057,11 @@ function og_ungroup($group_type, $gid, $entity_type = 'user', $etid = NULL) {
+  $admin_permissions = array('administer group', 'update group', 'add user', 'manage members', 'manage roles', 'manage permissions');

I'm not a fan of this approach, it hardcodes assumptions. Why not use hook_og_access_alter() to set the access according to your business logic?

Here's a slightly different approach to this problem. This patch creates global permissions for every OG role (and every group type) so that you can grant someone select OG roles in *all* groups of a given type without having to make them a member of all the groups.

> Why not use hook_og_access_alter() to set the access according to your business logic?

in my opinion, this question is still valid.

@Amitaibu in #13:

I agree that folks can solve this themselves in hook_og_access_alter(). I've used the same basic approach as in #10 but just implemented via hook_og_occess_alter() on a few projects of my own..

That said, the approach I took avoids specific business logic assumptions and solves a variety of use-cases that I've run across when building sites with OG 2.x. I thought it might be helpful to add it to the module.

Problem is that it adds a lot of new permissions - that could be overwhelming.

What if there were an option on the OG role to choose to expose it as a global permission?

Re-rolled against 2.x-dev

Updated slightly to work properly when a group has overridden permissions.

Oops, that needed parentheses. Fix attached.

This needs more work; I've run into trouble with assumptions made by OG's entityreference widget.

Since it's touching access, it will require also tests