Grouper Users - Open Discussion List

["Black, Carey M." <>]

Chris,

Thanks for the code snips. I am sure they will get me to a point that I can 
start to build something. :)


Thanks for asking for a better explanation. I know I dumped a lot of stuff in 
there . I think I now see how my post notation likely made the concepts more 
confusing that I wanted. 
Sorry about that, I was trying to be compact in my text.


Maybe the following helps? (Re written, expanded... more English than 
notation. )

"
The existing permission of "Create" does not support Create Group vs Create 
Stem (er... Folder) .
        These two attribute names ( allowFolderCreate and allowGroupCreate) 
provide a way to "tag" a stem and restrict those activities via a hook's 
stemPreInsert method...

> Attributes that can be assigned to folders (stems)
>       folderStructure         (Is an attribute def  that is "single 
> assignable" for a stem)
>               allowFolderCreate ( is an attribute name that is "single 
> valued" , "String")
                        Description: Use this constraint from the parent 
folder(s) to allow or veto a user create of new sub folders.
                        values only one of: 
                                        "ALL"(implied by not having the 
attribute on any parent stem), 
                                        "ONE", 
                                        "NONE"
>               allowGroupCreate ( is an attribute name that is "single 
> valued", "String")
                        Description: Use this constraint from the parent 
folder(s) to allow or veto a user create of new groups.
                        values only one of: 
                                        "ALL"(implied by not having the 
attribute on any parent stem), 
                                        "ONE", 
                                        "NONE"

                And if I really want to be hard on myself....( Version 2 of 
these attributes would be defined this way )
>               allowFolderCreateByGroup ( is an attribute name that is 
> "*multiple* valued" , "String")
                        Description: Use this constraint from the parent 
folder(s) to allow or veto a user create of new sub folders.
                        values  are a pair of strings where
                                 the first value is one of: 
                                        "ALL"(implied by not having the 
attribute on any parent stem), 
                                        "ONE", 
                                        "NONE"
                                Followed by a second value that is
                                        a "Group ID/REF"   Example: 
"etc:wheel"
                                        NOTE: "*" would mean all groups
>                       Example values: 
>                               "All", "etc:wheel"
>                               "NONE","*"                                  
>                               "ONE","etc:MasterOfAllStems"

>               allowGroupCreateByGroup ( is an attribute name that is 
> "*multiple* valued", "String")
                        Description: Use this constraint from the parent 
folder(s) to allow or veto a user create of new groups.
                        values are a pair of strings where:
                                        "ALL"(implied by not having the 
attribute on any parent stem), 
                                        "ONE", 
                                        "NONE"
                                Followed by a second value that is
                                        a "Group ID/REF"   Example: 
"etc:wheel"
                                        NOTE: "*" would mean all groups
>                       Example values: 
>                               "All", "etc:wheel"
>                               "NONE","*"                                  
>                               "ONE","etc:MasterOfAllStems"
"



I picture this kind of logic in the hook:

// Just using the "simple" model that does not depend on the users ACL's
// So not looking at the values in the " And if I really want to be hard on 
myself...." (version 2) of these attributes.
If ( New stem's parent(s) had the attribute " allowFolderCreate" defined on 
it) then
        If (allowFolderCreate.value == "ALL")   then
                Allow folder creation inside the stem with 
allowFolderCreate.value at all levels below the stem with the attribute.
        else (allowFolderCreate.value == "ONE") then
                Allow folder creation inside the stem with 
allowFolderCreate.value at ONLY one level below the stem with the attribute 
allowFolderCreate.value.
        else (allowFolderCreate.value == "NONE") then
                Do not allow stem's to be created below the stem with the 
attribute.
        end if
end if

Same general concept for the allowGroupCreate attribute.




A practical example...

Existing structures before attributes are added to any stems:
        Stem: Stem1:
        Stem: Stem1:Sub2
        Stem: Stem1:Sub3        
        Stem: Stem1:Sub4


Add attribute allowFolderCreate: to Stem1, Sub2 and Sub3 (with illustrative 
values)

Stem: Stem1:
        Attribute: allowFolderCreate = "NONE" on Stem1 would VETO new folders 
from being created.
                Stem:Stem1:* Not allowed.

Stem: Stem1:Sub2
        Attribute: allowFolderCreate = "ONE" on Sub2 would ALLOW new folders 
from being created at Sub2's child level, but VETO at Sub2's children's 
levels...
        Attributes assigned in Sub2 would mask value on Stem1.
                Stem:Stem1:Sub2:* allowed, 
                Stem:Stem1:Sub2:*:... Not allowed

Stem: Stem1:Sub3
        Attribute: allowFolderCreate = "ALL" on Sub3 would ALLOW new folders 
from being created beyond Sub3. (Child and Children levels)
        Attributes assigned in Sub3 would mask value on Stem1.
                Stem:Stem1:Sub3:* allowed, 
                Stem:Stem1:Sub3:*:*:.... allowed

Stem: Stem1:Sub4
        No allowFolderCreate value assigned here. So Stem1's value would be 
found and used for Sub4 as well.
                VETO  new folders from being created. 
                Stem:Stem1:Sub4:* Not allowed.
                



-- 
Carey Matthew 


-----Original Message-----
From: Hyzer, Chris 
[mailto:]
 
Sent: Monday, September 11, 2017 10:40 AM
To: Black, Carey M. 
<>;
 

Subject: RE: Does this make sense? or am I not looking at this right?


> If you want to know my current wish list... here it is: (WARNING:  
> Lots of details, might be half baked at this point....)
> 
> Here is what I am thinking for attributes and their functions( Hook 
> responses ):

After a quick read I dont really know how these attributes would be used with 
hooks.  Maybe some simple examples of attribute values and what the hook 
would do...  

thanks
Chris

> 
> Attributes for folders (stems)
>       folderStructure         (def:single assignable)
>               allowFolderCreate (name: single value) values only one of: 
> "ALL"(implied by 
>               not having the attribute), "one level", "NONE"
>               allowGroupCreate (name: single value) values only one of: 
> "ALL"(implied by 
>               not having the attribute), "one level", "NONE"
>                               Use this constraint from the parent folder(s) 
> to veto user 
>                               creates.


 <snip> 
> --
> Carey Matthew Black.123
> 
>