I have a very particular use case, and your module gets me most of the way there. I'm willing to help code this, but just wanted to make sure you would support this change before coding it as part of your module.

What I want to do is make it possible to lock down editing permissions. Here's the use case. I have a site where each organic group represents a project in a city (for example New York and Toronto), my site has a user role like "city admin". I have a content type, lets call it city page, it is set to require in the default group settings. What I want to do is give "city admin" the rights to create a "city page" only for a city that they are a member of (the module handles this already). I also want to give them the ability to edit other city pages for their city if they are group administrators and their role has edit permissions for the content type. Currently if I give a user role "edit city page" permissions, a New York admin can edit Toronto pages. I want to make that impossible.

The end result of these changes is being able to make a user roll that can be elevated to the level of group admin, where they can add and edit content within their group, but not outside of a group that they are administrators of.

There are a few way within the drupal api, and your module's existing code, that I could see handling this. I am happy to go with a method that you think fits best with existing code in your module. I am thinking of adding something to the hook_nodeapi edit case that runs a series of checks (groups for node and user, perms, etc) and then sets an error if all the conditions are not met. I also see this as being an optional feature, which means placing and on/off toggle somewhere. There may also need to be a permission where these restrictions are overlooked, so site admins do not have to be a member of every group to edit content within a required group type.

Comments

rconstantine’s picture

Status: Active » Closed (won't fix)

Just use og_user_roles. It does everything you outline that this module doesn't and is what I use myself. It's really cool and has more features than you need. To sum up, you can give users full site admin rights (for example) but only within a particular group or groups. Since the permissions are based on roles, whatever permissions you give the role applies. You can also allow group admins to assign their members to roles which also are valid only within that group. And so on, and so on...