search

apostrophecms / apostrophe

A full-featured, open-source content management framework built with Node.js that empowers organizations by combining in-context editing and headless architecture in a full-stack JS environment.
https://apostrophecms.com
Other
4.36k stars 590 forks source link

Clarify for the user that page permissions settings are applied across all locales, unlike other page settings #3452

Open Ramakrishnan-Sathyanarayanan opened 3 years ago

Ramakrishnan-Sathyanarayanan commented 3 years ago

Apostrophe 2.102.3

To Reproduce

Step by step instructions to reproduce the behavior:

  1. Go to Home page
  2. Click on Page Settings > Permissions > Who Can View this page? > LoginRequired
  3. Save the Settings
  4. This Setting change is reflected across all the locales of the Home Page

Expected behavior

A change in the Login Required in pages between Locales should be independent

Describe the bug

Login Required changed in one locale page is reflected across all the locale pages. Ideally we were expecting it to reflect only in one page.

Details

Version of Node.js: 10.24.1

Server Operating System: Amazon Linux 2

Additional context:

Add any other context about the problem here. If the problem is specific to a browser, OS or mobile device, specify which.

Screenshots image

Ramakrishnan-Sathyanarayanan commented 3 years ago

My initial take, The db update criteria is based on the path attribute of the document. Path attribute is same for all the locale pages. Eg: '/' for all the language home pages. This might trigger a permission copy to all the matching path pages every time.

https://github.com/apostrophecms/apostrophe/blob/71e002bb176d7d76ce17bfc5fbf1d5efe0fcf7fd/lib/modules/apostrophe-pages/lib/api.js#L263

If the above context is valid, should we add a unique identifier to the criteria db filter in the mentioned line?

Ramakrishnan-Sathyanarayanan commented 3 years ago

Permissions tab in Page Settings is updated based on workflowGuid(all locale pages) contradicting to other tabs in the same Page Settings(page specific). There are no note/warning mentioning this and it is kind of misleading provided it is mentioned as "Change the settings of a page.".

image

https://github.com/apostrophecms/apostrophe-workflow/blob/0d14379f00ad05dc894e4275af11be99fa3aad2a/lib/callAll.js#L303

boutell commented 3 years ago

I agree that from a UX standpoint it would be better if we made this clear, but all permissions for pages do indeed cascade across all locales, as this allows a significant simplification of the permissions interface: what you can do is a combination of two separate things, what documents you're allowed to edit and what locales you're allowed to edit. That won't be changing, but I agree it would be helpful to document it here for the user editing the page settings, so I'll keep this ticket open with a new title. PRs welcome on this.