ACL and Rules

As you can see, the above code took some time for me to rave it through. apart from the time spent on studying the api.

the above code was a snopshot or a rules which mainly served the following purpose:

The whole point is the ability to programatically be able to grant/revoke certain permission to users on certain nodes. this differs from giving them a permenent role or a permanent permission.

I do not want to use virtual roles or introduce new temporal roles.

Partially, the following module is serving my purpose:
http://drupal.org/project/nodeaccess_userreference

But the problem with the above module is that it operates in static access grants which are set at cck field level.

What if I wanted to remove that permission automatically from that node in case it goes through different workflow ..

The possible answer is to use the workflow fields access helper module, which in essence gives you access control on the field level rather than node level, that is, more granular and fine.

The problem and need arises more in the following scenario:

and NodeX is workflow enabled

-- I am using the workflow module + workflow field access

-- We have nodeX and nodeY
nodeY is having a nodereference pointing to NodeX

-- Certain node type (nodeX) is subject to workflow (WorkflowX)

-- The node travels through different workflow state, and naturaly inherits different permissions from the workflow access module per each workflow state.

Now observe:

-- nodeX is a parent, and nodeY is a child, as a one-to-many relation.
-- Permission to 'Edit' nodeY should go side-by-side with the permission applied to its parent from the workflow module
-- As soon nodeX leave certain workflow state, I am setting up a rule to clear reset the ACL on all child nodes
-- Equally, vice-versa, As soon as NodeX gets pushed back to the same workflow state, I want all child nodes to be equally affected and to allow editing again,

I hope this clarifies better.

------------

I am not a php developer, hoped to better enhance this module, rather, I use lasso middleware from lassosoft.com

with it I was able to develop a new dashboard that interacts with workflow fields access module

see the snapshot, I do not mind sharing the source-code of the lasso scripts.

The project which i work on is a helpdesk application in addition to automating many complex bussiness workflows for different node types...

1) I am already using the user

You are right, it is a specific requirement.

though i am happy with the existing acl module.

it is only interesting how advanced things can go.

My Salues..

This ACL api functions worked fine for me

$nid = $node->nid;

$this_wf_state = $node->	field_current_wf_state[0][value];

$approver_1	=	$node->field_hidden_1st_approver[0][uid];
$approver_2	= 	$node->field_hidden_2nd_approver[0][uid];
$approver_3	= 	$node->field_hidden_3rd_approver[0][uid];

$field_mgmt_approval_level	= $node->field_mgmt_approval_level[0]['value'];

if      ($field_mgmt_approval_level == '1')
	{
		$Active_Assignee_uid		= $approver_1; 
	}
else if ($field_mgmt_approval_level == '2')
	{
		$Active_Assignee_uid		= $approver_2; 
	}
else if ($field_mgmt_approval_level == '3')
	{
		$Active_Assignee_uid		= $approver_3; 
	}


// ------------------------------------------------------------------------------
//  Grant Access to NEW Assignee
//  Create/update an 'EDIT' ACL entry for this 'Ownership-Entry' 
//  ----------------------------------------------------------------------------
// Definition of function::  function acl_node_add_acl($nid, $acl_id, $view, $update, $delete, $priority = 0)

$module_name = "acl_example";

$acl_edit_id = acl_example_get_or_create_acl_by_prefix_nid($nid, 'edit');


if ($this_wf_state == "Under Approval (Mgmt)")
	{
	
		// CLEAR all relevant current node & /user associations with this ACL entry: "$acl_edit_id"

		acl_remove_all_users($acl_edit_id);
		
		// ADD all node associations with this ACL entry

		acl_node_add_acl($nid, $acl_edit_id, 0, 1, 0, 0);
		
		acl_add_user($acl_edit_id, $Active_Assignee_uid);


	}
	
		
// Gets the list of node access grants and writes them to the database
node_access_acquire_grants($node);