Forum OpenACS Development: Idea: Give every package_id an application group

This would lead the way to more consistent application of permissions for each package. That is, we could offer a consistent user interface to add an administrator to a package.

That is, when the package is created we create a new application group, create the admins and members relational segements, then grant default permissions (ie: grant admin over the package_id to the admin relational segment).

Does this sound like a good idea? It doesn't require using the application group, but should allow us to make it easier to use the existing permissions system in a consistent way. Right now every package would have to do this individually.

Good point. There are Tcl procs to do this already.

My goal was to make it simpler to accomplish a common goal, and to define a best practice. We have too many different ways to do things, and no clear path to accomplish common things.

Tom asked "... how are admin permissions granted on package objects in the usual case? Is there a document that suggests usage of context_id, etc.?"

As far as I can tell, there is no common way to do this.

I believe the common case is to grant admin manually over a subsite, or a package, or as a shortcut, many sites have one person who admins everything, so he is just site wide admin, reducing the need for specific permissions.

I have a case where I need folks to be admin over just this one package, and i need to also give the admins of this package permissions over a few other objects. The ability to take a subset of users and grant them permissions over a few random objects outside the package is the reason to use a relational segment. I can add users to the relationsl segment and I don't have to track down every random object they need admin over.

It means someone knowledgable with OpenACS pokes around in the subsite administration pages.

The current packages that have some concept of "partial admin" privileges include

Assessment, Categories, Forums, LORSM.

The question isn't how many packages support this, but what would it take to make the handling of package administrators consistent across the toolkit.

The other question is, what if you have a large site, where there are users who don;t need site wide admin privileges, but only need to manage one package.

It also allows administrators to delgate tasks to other users without giving them permission over everything.

Once we do this, we still need a sane and usable interface to choose a user and add them to the group. That is a another proposal.