Role Assignment Specific to Group [#78017]

I would like to assign roles to individual group users for group access, as opposed to assigning them to users for global access (the way OG Roles works now).

I'm willing to take a crack at this myself, but I need some help. Right now, OG Roles writes the role/userID to users_roles table.

I figure I could instead write this information to another table, say "og_roles", that would consist of the uid (userID), rid (roleID) and gid (groupID).

Next, I would need to be able to use the "og_roles" table to tell Drupal what the a user's role is in accessing content within a particular group. This is where I need help.

If there isn't some sort of hook within OG that looks for permissions when accessing group content, can you tell me where the permissions hook is that I would need to look at in order to add the functionality I am suggesting (i.e., if the userID and content groupID match that in "og_roles" table, then assign the permissions from the the matching roleID)?

Thanks for any guidance whatsoever. Or, if it is something you would consider doing, please let me know.

Comments

Comment #1

somebodysysop commented 11 August 2006 at 00:02

I have located the hook.

OG Roles writes the permissions for a user to "users_roles".

I could modify OG Roles to write to a new table, "users_ogroles", and include the uid (user ID), rid (role ID) and gid (group ID).

In the Drupal API, I found "user_access" which is used by "hook_access":

Determine whether the user has a given privilege.

All permission checks in Drupal should go through this function. This way, we guarantee consistent behavior, and ensure that the superuser can perform all actions.

And, within this function I located this cache statement:

// To reduce the number of SQL queries, we cache the user's permissions 
// in a static variable. 
if (!isset($perm[$account->uid])) { 
$result = db_query("SELECT DISTINCT(p.perm) FROM {role} r INNER JOIN {permission} p ON p.rid = r.rid WHERE r.rid IN (%s)", implode(',', array_keys($account->roles))); 

$perm[$account->uid] = ''; 
while ($row = db_fetch_object($result)) { 
$perm[$account->uid] .= "$row->perm, "; 
} 
}

I am guessing that this part of the statment: ($account->roles) retrieves the rids (role IDs) from the users_roles table.

How could I re-write this statement so that it still returns hits from the users_roles tables, but ADDs to this list the following rids from the "users_ogroles" table?:

SELECT rid from users_ogroles WHERE uid = $account AND gid = $groupID;
(where $groupID is the OG Group ID number for the content we are requesting access to)

Theoretically, if I could pull this off, I would be able to create the functionality I seek, at least for all nodes that use the user_access (or hook_access) function to check permissions.

I have asked this question in the general forum, but can you shed any more light on this?