Complex access rules help [#2650266]

The majority of our users is Author and Lead in our workflow for a specific institution.
We have several pages that have multiple institutions as authors, and one of those institutions also as lead.
We use a complexe moderation workflow with different states (draft, need review, request staging, request for publish).

In this example :

User A has roles "Author for institution 1" AND "lead for institution 1"
User B has role "Author for institution 2"
User C has roles "Author for institution 3" AND "lead for institution 3"

I create 2 pages :
In The first page, I have selected in the access section field :
Author for institution 1, Author for institution 2, Lead for institution 1.
In the second page I have selected in the access section field :
Author for institution 1, Author for institution 3, Lead for institution 2

User A (author institution 1) will have lead permissions (request for staging, request for publish) for Page 1 AND Page 2, because those permissions are linked to the user (2 roles associated to the user), and are currently not linked to the combination user/Lead institution.

I would have :
Page 1 : User A is author and lead --> oK selected by the access field "section".
Page 1 : user A is only author because I have selected only "Author for insitution 1" and not "lead for institution 1" in the access field !

can I do that without create 2 differents users (access) for the same institution ?

Comments

Comment #1

14 January 2016 at 13:53

pixelpreview created an issue. See original summary.

Comment #2

fiammybe commented 18 January 2016 at 08:24

I'm also working on this site, and I'll give some info about the ideas we came up with, and the challenges they represent. That might give a better view of the issue as well.

Each user is on a matrix, where he is at the crossroads of

a role type of access among author, lead or publisher
one or multiple organisations (currently we have

The reason we took this approach is so that we can define the permissions for the roles just once. If not, we would have to split each organisation in 2 or 3 roles, and we already have a full load of organisations : 34 (and perhaps a few more to come). The workbench email module is having trouble coping with the number already.

This was a dirty solution we came up with : split the permissions, so that we have a role for organisation 1 author, and another one for organisation 1 lead.

What we would need, is a way to add some kind of relation with the organisation role, and get Workbench to take that also into account everywhere. Any suggestions would be most welcome.

Comment #3

bdeclerc commented 21 January 2016 at 11:58

I'm wondering i Rules integration could not help - it should be possible to do a "2-role check" using Rules on Workbench Moderation triggers - this might be less than perfect in that it might block the "not-permitted" action after it is attempted, rather than not showing it in the UI, but that might be good enough for your use-case (or at least good enough to reduce the urgency of a better solution)?

Comment #4

fiammybe commented 17 February 2016 at 22:12

Hi bdeclerc : we tried that initially, but the Rules modules we know of don't offer the Workbench-related fields that we would need in order to trigger the rule.