Add a "Cascade Shelf Permissions" command to run the "Copy Permissions to Books" action for all shelves

[Joonake]

Describe the feature you'd like I could not find any way to automatically inherit permissions from bookshelf to all books under it. There is a button in shelf permission settings but I would like to automate this so every book moved to 'secret shelf' would automatically inherit the permissions of 'secret shelf'

Describe the benefits this feature would bring to BookStack users Automated inheriting would eliminate the need of clicking 'Copy Permissions to Books' after creating every new or moving existing books to shelf.

I tried to dig up the source code and found php function 'copyPermissions' but I have no idea how to call this function outside the whole framework.

[ssddanbrown]

Hi @Joonake, Thank you for your request.

Bookshelf permissions do not automatically cascade for technical reasons. A single Book can be on multiple shelves. In this event you could get conflicting permissions. I think any auto-resolution of this could cause odd, unexpected permission behaviour.

I can see the use-case though. Maybe, If we add a command line action to auto-set permission? If a book is in multiple bookshelves then the latter shelf would take priority. You could then set a cronjob or similar to run this action every day or so. Would that suffice?

[Joonake]

Dear @ssddanbrown, thank you for your reply. Yeah just noticed that there would be a problem if book is on multiple shelves. In my case it would be sufficient if one could run shelf-specific copyPermissions function from command line. Then all the books on specific shelf would be protected no matter what other shelves they are on or what order they were added to each shelf.

[Beeez]

I second this as an option. It would be great to at least include this as an option on the shelf permissions page. It is easy enough to create a new Book under another shelf if needed to have a duplicate.

Perhaps if it is found that a book is in fact on multiple shelves, to report that as an error noting the shelves it is a part of? And possibly giving the option to split the book into two separate books from there

[ssddanbrown]

Perhaps if it is found that a book is in fact on multiple shelves, to report that as an error noting the shelves it is a part of?

@Beeez Thanks for the suggestion but I wouldn't want to show an error for this, since this was intended to be the main unique feature of shelves.

[Beeez]

@ssddanbrown Understandable. I guess we could just Copy Permissions To Books after every book is created under a shelf.

[ssddanbrown]

Issue title updated to reflect the discussed resolution

[joaomezzari]

I look forward for this feature aswell.

[joaomezzari]

@ssddanbrown Is the command line thing coming out any time soon?

[ssddanbrown]

Targeting this for the next release (v0.28)

[safaci2000]

This is pretty critical, and TBH i expected a level of inheritance to be there.

Ideally, I'd love to have the ability to say:

users part of Role 'Tech' can read/write to the bookshelf named Engineering and any new book I create is instantly inherits the permissions from the bookshelf.

I can override the permissions on a given book or chapter but by default, the top-level should trickle down.

The current behavior doesn't seem to have much support for ACL. Or maybe I misunderstand the app.

A user can't edit anything unless he's part of Editors. I need to explicitly grant the Role permission to edit a bookshelf then if a user creates a book under the bookshelf I have to go back and fix the permissions again.

I hope this release fix this, though I think you may want to revisit how the data model works. Just my 2 cents from a usability perspective.

[ssddanbrown]

@safaci2000 To confirm the current state of things, Inheritance is available on Books > Chapters > Pages. Shelves does not automatically do this I think it could create confusing behaviour since a single book can be in multiple shelves.

[Cidwill]

@ssddanbrown Is the ability to add permissions application on shelves into a Chron job still intended as an option for v0.28?

[joaomezzari]

It would be nice to actually select which shelves will have the behaviour too.

Att, João

On Tue, Sep 24, 2019, 9:50 AM Cidwill notifications@github.com wrote:

@ssddanbrown https://github.com/ssddanbrown Is the ability to add permissions application on shelves into a Chron job still intended as an option for v0.28?

— You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/BookStackApp/BookStack/issues/1091?email_source=notifications&email_token=AMUXECSHHT6UNF4CE2B6KQTQLIEH5A5CNFSM4F7QGCJ2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOD7OGM6Y#issuecomment-534537851, or mute the thread https://github.com/notifications/unsubscribe-auth/AMUXECVPDTXXCAXBO5SKRVTQLIEH5ANCNFSM4F7QGCJQ .

[sunnybeats]

I think i have another idea to this topic. What is if there would be a possibility of creating a new type of shelf which has Inheritance available but you can not put any existing Books into it. Only create new chapters, books and sites.

So you need to decide which type of shelf you want to get, in the moment you creathe a new shelf(maybe a checkbox which enables this option.)

A thinkable cenario could be shared shelfs. Where everyone of a specific group can create books in and all members of the group can see and modify it to work together.

Hope its understanable written.

[ssddanbrown]

A command has now been added in master, to be in the next feature release.

There will be the following ways of running the command, depending if you want to target a single shelf or run for all shelves:

php artisan bookstack:copy-shelf-permissions --all
php artisan bookstack:copy-shelf-permissions --slug=my_shelf_slug

[ssddanbrown]

@sunnybeats That's a neat solution but I'd want to avoid having multiple structural models via options just for the sake of permissions; Could add to the confusion. I'll probably have a deeper think about what can be done for shelves generally once I come to review the permission system as a whole.

[Beeez]

Thank you for getting this integrated. It will be very helpful! I will probably set up some cron jobs to do this daily some some of my shelves. 💯

[andrecallman]

I Added some lines on app/Console/Commands/CopyShelfPermissions.php Ive inserted the option --yes to ignore prompt

I guess it helps all of us CopyShelfPermissions.zip

[ssddanbrown]

Thanks @andrecallman for sharing your work but this is already supported by passing the -n or --no-interaction flag.

You can see all options on the help page of the command by using the -h flag:

php artisan bookstack:copy-shelf-permissions -h

[kobaz]

@safaci2000 To confirm the current state of things, Inheritance is available on Books > Chapters > Pages. Shelves does not automatically do this I think it could create confusing behaviour since a single book can be in multiple shelves.

But in the simple case where a book is on ONE shelf. (Which most people are using). Then a simple cascade can happen. Once the book is added to another shelf, then manual permissions would need to happen.

The easy fix is to ONLY inherit on create. And by default you can only create in one shelf at a time.

Flow: 1) Create book directly on shelf, where the shelf has a (new) setting 'Inherit on Direct Create' 2) The new book will now inherit all permissions in the same way as 'Copy Permissions' would set 3) Someone in the 'Tech' role who has access to the 'Tech' shelf, who also has Create permissions could create their own books and see their own created books, and everyone else can automatically see them in the 'Tech' role 4) This solves the problem where someone has Create Book, but they create the Book and then have no visibility to their own book they just created. (This seems more like a bug than a missing feature)