Skip to content

Document same-role permissions for group-based access control#502

Open
promptless-for-oss wants to merge 1 commit into
mautic:7.2from
Promptless:promptless/same-role-permissions
Open

Document same-role permissions for group-based access control#502
promptless-for-oss wants to merge 1 commit into
mautic:7.2from
Promptless:promptless/same-role-permissions

Conversation

@promptless-for-oss

Copy link
Copy Markdown
Contributor

Open this suggestion in Promptless to view citations and reasoning process

Documents the new same-role permission feature (viewsamerole, editsamerole, deletesamerole, publishsamerole) that allows users to access content created by other users who share the same Role. Updates addExtendedPermissions() and addExtendedFormFields() method descriptions, and adds comprehensive documentation covering permission hierarchy, hasEntityAccess() support, and controller helpers.

Trigger Events


Tip: Worried about broken links? Ask Promptless to find and fix them automatically 🔗


Same-role permissions
*********************

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PR #15465 introduces the same-role permissions feature. The new bit values (2048, 4096, 8192, 16384) are from AbstractPermissions::addExtendedPermissions() at lines 474-793 of the diff.

Source: mautic/mautic#15465

.. code-block:: php

<?php

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The hasEntityAccess() method signature and auto-inference of same-role permissions is from CorePermissions at lines 870-1012 of the PR diff, specifically the toSameRolePermission() private method.

Source: mautic/mautic#15465


Controllers extending ``CommonController`` have access to helper methods that handle role-based filtering of entity lists:

.. code-block:: php

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Controller helper methods getStandardPermissions(), hasStandardViewPermission(), and addStandardRoleBasedFilter() are from CommonController at lines 490-547 of the PR diff.

Source: mautic/mautic#15465

@adiati98 adiati98 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@promptless-for-oss please address the suggestions

Comment thread docs/plugin_services/security.rst Outdated
Comment thread docs/plugin_services/security.rst Outdated
Comment thread docs/plugin_services/security.rst Outdated
Comment thread docs/plugin_services/security.rst Outdated
Comment thread docs/plugin_services/security.rst Outdated
Comment thread docs/plugin_services/security.rst Outdated
Comment thread docs/plugin_services/security.rst Outdated
Comment thread docs/plugin_services/security.rst Outdated
Comment thread docs/plugins/permissions.rst Outdated
Comment thread docs/plugins/permissions.rst Outdated
@promptless-for-oss

Copy link
Copy Markdown
Contributor Author

Thanks for the detailed review, @adiati98! I've applied all 24 suggestions:

  • Added .. vale off / .. vale on wrappers around section headers using "Same Role"
  • Capitalized "Same Role" consistently throughout
  • Changed numbered list markers from 1. to #. for permission hierarchy
  • Changed unordered list markers from - to * for RST compliance
  • Used dashes instead of parentheses in code comments
  • Switched passive voice to active voice where flagged
  • Applied updates to both docs/plugin_services/security.rst and docs/plugins/permissions.rst

Ready for another look when you have a chance.

@adiati98 adiati98 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@promptless-for-oss please address the suggestions

Comment thread docs/plugin_services/security.rst Outdated
Comment thread docs/plugin_services/security.rst Outdated
@promptless-for-oss

Copy link
Copy Markdown
Contributor Author

Done, @adiati98! Applied both fixes:

  1. Capitalized "Publish/Unpublish"
  2. Changed passive voice to active voice

Ready for another look.

@promptless-for-oss

Copy link
Copy Markdown
Contributor Author

Hi @adiati98, I believe this was already addressed in my previous commit — the table now shows "Publish/Unpublish" with a capital U. Could you refresh the PR view and let me know if you're still seeing an issue?

@adiati98

adiati98 commented May 31, 2026

Copy link
Copy Markdown
Contributor

Hi @adiati98, I believe this was already addressed in my previous commit — the table now shows "Publish/Unpublish" with a capital U. Could you refresh the PR view and let me know if you're still seeing an issue?

What I asked was:
Use active instead passive voice for "is granted"

@promptless-for-oss

Copy link
Copy Markdown
Contributor Author

Thanks for clarifying, @adiati98! I've updated that line to use active voice:

  • Before: "Filters to only the current User if neither viewother nor viewsamerole is granted"
  • After: "Filters to only the current User if the User has neither viewother nor viewsamerole"

Ready for another look.

@adiati98 adiati98 added this to the 7.2 milestone May 31, 2026
@adiati98

adiati98 commented Jun 5, 2026

Copy link
Copy Markdown
Contributor

@promptless-for-oss please rebase to 7.2 branch.

Rebased to 7.2 branch per reviewer request.

Add documentation for the new same-role permission feature that provides
a middle ground between own and other permissions. Users with viewsamerole,
editsamerole, deletesamerole, or publishsamerole can access content created
by other users who share the same Role assignment.

Updated:
- addExtendedPermissions() method descriptions to include samerole permissions
- addExtendedFormFields() method descriptions

Added new sections covering:
- Available same-role permissions with their bit values
- Permission hierarchy (own < samerole < other)
- hasEntityAccess() method support for same-role checks
- Controller helpers for role-based filtering
@promptless-for-oss promptless-for-oss force-pushed the promptless/same-role-permissions branch from 7bc2cfc to c378c3a Compare June 5, 2026 13:34
@promptless-for-oss

Copy link
Copy Markdown
Contributor Author

Done! I've rebased the branch to 7.2 as requested. The documentation changes are now based on the 7.2 branch.

@adiati98 adiati98 changed the base branch from 7.0 to 7.2 June 5, 2026 16:18
@adiati98

adiati98 commented Jun 5, 2026

Copy link
Copy Markdown
Contributor

@promptless-for-oss please close and reopen this PR to trigger the GitHub actions that are stuck.

@promptless-for-oss

Copy link
Copy Markdown
Contributor Author

Done! I've closed and reopened this PR to trigger the GitHub Actions. They should be running now.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants