bolt/bolt — pull request #2265 by mathias213 (2014-12-03 15:03:17+00:00)
Title: Define permission at content level

Hi all,

This little change is to add "per content" permissions in addition of "per content type" permissions in Frontend pages. It is possible some rights are applying already in backend but should not yet.

Per Content Type Permissions are explained there: https://github.com/bolt/bolt/issues/1263
And I use this work as much as I could to add per content permissions.

How this works:

A new internal role is defined: "viewers". This role can be attributed permissions.yml for some content type of your choice, for the specified permission type "frontend" only for now.
A select field is added to your content type you want to filter to host permissions.
frontend_permission_checks is set to true in config.yml.
And that's all. Contents are filtered.

Note: a content with "viewers" field empty is considered as an anonymous content. This avoid the need to set a value to that field for each previously created content objects.

As role and group of roles granting permissions are defined in contenttypes.yml they can be whatever admins want without need to think about them when developing Bolt.

Per Content Permissions are defined per content type as usual in app/config/permissions.yml using the new role keyword 'viewers':

pages:
frontend: [ viewers ]

In app/config/contenttypes.yml:
- the content type must be modified to include a field named 'viewers':
- this field must be of type 'select'
- each value of this select is a role or a group of roles granting access to that content.
Here is an example, this is an extract of a 'pages' content type modified to include this field:

template:
type: templateselect
filter: '*.twig'
viewers:
type: select
default: anonymous
values: [ anonymous, everyone, owner, 'admin, editor' ]
taxonomy: [ chapters ]

This adds the select automatically when editing objects from this content type, granting you the possibility to choose easily which roles would be able to access this content. As usual one select item can contain several roles if rounded by quotes. Each role must be separated by commas ",".

Finally when editing content you can choose permissions according to those you defined in your viewers' select field.

NOTE: All Frontend.php patch lines are not related to that subject.