Is this module working or in use and tested?

[somatonic]

I'm not sure what this module is used for or if it's even used anywhere . But currently the drawbacks this module brings (if assuming it's working) defeat its own purpose.

What is the purpose of this module when it doesn't allow me to define "where" to add pages, without giving the role "add chilrdren" access to the parent template? Cause then the user can also add pages in other places which I can't control then. Since it's not revoking access makes this approach very difficult. Or maybe there's bugs or I don't understand how to use it or for what special scenario.

Also as mentioned in other issue. When I'm not setting access on template level, the "Add new" feature isn't working and if I give access on template level there's no use for DynRoles anymore.

[somatonic]

Current biggest problem I see with this is

Let's assume I have two branches. Same template structure

Branch1
   Ressort
      news-article
      news-article
      news-article

Branch2
    Ressort
       news-article
       news-article

Now without setting any access to templates except view access on home.

I want to have editorA edit new-articles but only in Branch1. So I set the dynrole that the role can edit and set the page editable to has_parent=branch1. Now he can edit the pages under Branch1 but can't under Branch2. Fine so far.

Since he should also also be able to add news-article in Branch1 (Ressort) I set a filter to select the Ressort under Branch1. - But it isn't working. He doesn't have access right to create pages with the news-article template. Ok, so after giving him access right to view,edit, add pages on this template it works. The Ressort page under Branch1 gets a "new" button and he can add pages. BUT he can now also edit the new-article pages under Branch2 which I don't want and why I'm trying to use DynRoles here in the first place.

Further side effect of this is that if I don't specify access edit/add rights on the news-article template there's no "Add new" button as it seems it doesn't know about "what" template the user is allowed to add pages. If I add these access rights on the template the "Add new" button appears again and seems working, so maybe there's a way to then get DynRoles "remove" edit access if it's now in the allowed pages to edit? Otherwise I can't see this module being much powerful as you loose a lot of power too.

[horst-n]

+1

[ryancramerdesign]

Soma, you can definitely accomplish what you are trying to do here with Dynamic Roles, but a couple things to be aware of:

1. Your "what can they edit" selector is going to have to include mention of one or more templates. It's fine to have a has_parent in there to limit it to a specific branch in your tree. But page-create is a template-specific permission. ProcessWire checks that a template is editable outside of the family tree before it takes the tree into account. If there's no mention of what templates are editable, there's no way to resolve a page-create permission. So if you want the user to be able to add pages, consider mention of one or more templates required in your "what they can edit" selector. Once you add that in there, you should then get the result you are looking for. I will add a note about this in the Dynamic Roles readme file, and will keep thinking if there is anything I can add to clarify this.
2. Second point I wanted to mention is that when you start defining permissions in Setup > Templates > Access, they take over. Dynamic Roles add access, they don't revoke it. As a result, if you want to reduce confusion, I would avoid any crossover between what your dynamic roles are allowing access to and what your template-level permissions are allowing access to (other than maybe view access if you want). There is no access control scenario I'm aware of where it is necessary to combine access control from both.