I fixed a few issues where manage MERCI wasn't granting the user the permissions they needed to add accessories or updated Reservations.
While looking at permissions, I don't think administer MERCI is needed. administer MERCI without administer content types permission won't grant the ability to configure the MERCI settings for a content type.
In most other cases, administer MERCI or manage MERCI both grant the same permission.
Do we need to rename or split up create confirmed reservation permission? In merci_form, we are checking for permission to create confirmed reservations to determine whether to grant user the right to edit a reservation.
Do we need permissions to create, edit, and delete confirmed reservations?
Comments
Comment #1
kreynen commentedAs I'm moving functionality to merci_pricing, I'm removing a lot of the functionality limited to Administer MERCI. Tagging this as merci_rc.
Comment #2
darrick commentedI still think this is a worth while permission. I look at the administrator as one who can create new content types and also adjust the merci settings for those types. They should also be the only ones able to adjust the settings for the reservable items.
Good things for only the admin to do:
- Change default availability.
- Change number of spare items.
- Set the hours of operation.
manage MERCI should be able to change the settings for reserved items and edit the reservations.
I updated the docs here: http://drupal.org/node/1013528 based on issue #1017812. At least for now that's what I've done in the code.
Comment #3
kreynen commentedStill need to add an update hook, but I've made this change and changed the permission checks in some of the functions so that manage reservations allows anyone in that role to check equipment in and out.
This language requires less explanation and is more in line with what other modules use.
Administer MERCI and manage reservations no longer act as "uber-permissions". A user with manage reservations that isn't given permission to make reservations outside the hours of operations will not get that permission. To start a checkout, a user would need both the administer MERCI and manage reservations permissions. Both of these permissions still require the 'access administration pages' permission as well to be useful. Administer MERCI requires the 'administer content types' permission to access the merci specific, settings but all users with 'administer content types' permission won't be able to adjust the MERCI Settings.
Now that permissions like 'view pricing', 'edit pricing', and 'administer pricing' only appear when the merci_pricing module is enabled, it is easier to break those permissions down without overwhelming the user with options.
Comment #4
darrick commentedCompleted in commit: http://drupal.org/cvs?commit=504680
I didn't do much in the update function other then direct folks to the documentation page: http://drupal.org/node/1013528
Figured it was best the site admins review their current permissions and it's not that hard for them to select the manage reservations where they used to have manage MERCI selected. Also they will need to review the other settings which both administer MERCI and manage MERCI no longer inherit.
Comment #5
darrick commented