Enforce different userlevels

[bobdenotter]

Make sure that users with different userlevels actually have different priviliges in the backend.

[pvankouteren]

Which userlevels should be present and how many 'layers' would there be? (Admin, Moderator, User in three layers or something alike?)

[bobdenotter]

Currently there are three levels:

• Developer (the person(s) who build a site using Bolt)
• Admin (the person(s) who administrate a website, built with Bolt)
• Editor (the person(s) who write/edit content in a Bolt site)

Obviously, these roles can overlap and often these will be the same people. What i think the different levels should be allowed to do:

• Editor: edit (add, change, delete) records in the content-types that the user is allowed. This means that it should be possible to have an editor that can edit 'news', but not the 'pages' in a site. I think i'd like to keep this simple: if a user is allowed for a certain contenttype, he/she will be able to edit all records in that content-type, regardless of who created the record initially. Editors are allowed to upload images/documents to go along with the content they create.
• Admin: allowed to edit records in all contenttypes. Allowed to administrate the users of 'editor' level. This means an admin can add or disable an 'Editor', but not add or modify other 'Admin' users. Admin users can upload files, but they can also use the 'uploaded files' screen, and delete uploaded files. Editors are not allowed to modify the .yml files in app/config, nor the templates in theme/
• Developer: Can do everything.

That's basically it, I think. Do you agree? :-)

[pvankouteren]

What about regular users? Or do you only want the CMS to be able to create a website and not leave room for a community functionality?

And do we hardcode these roles?

[bobdenotter]

The users are only for people who have access to the backend. And yes, let's hardcode them. :-)

As for comments: Just use Disqus or Facebook comments, as they work just fine.

That said, we are working on an extension for a site for a client, that allows authentication for visitors using either facebook, openid, twitter or google.