Workflow: Allow Contributor and Author to edit content they didnt author

[msayoung]

David raised the following:

role 1 (contributor) and role 2 (author) to be able to create new drafts of existing published content.

Currently they can't do this. We are doing a mass content migration of pages administered by the central digital team. This would mean that those pages automatically belong to us and our editors, when we train them up, would not be able to edit them. I would imagine this situation could be similar at other councils.

[finnlewis]

Discussing with @stephen-cox and @msayoung :

By default, if we allow a user to edit anybody's content, they can publish that content by default.

We want to be able to allow them to edit any content, but not publish it.

The author should be able to edit any content, but then just save it to draft or needs review.

There might be a contrib module to help with this.

Otherwise, we will need to write it.

Assumptions:

Find contrib to help (or write something?) Set some config. Deploy all the config. Write some tests.

Acceptance tests:

• Contributor creates content X.

• Author can edit content X.

• Author cannot publish content X.

• Author can save content X as 'needs review'

• Editor creates content Y.

• Contributor can edit content Y.

• Contributor cannot publish content Y.

• Contributor can save content Y as 'needs review'

[stephen-cox]

The basic problem here is that Drupal's Content Moderation permission system doesn't distinguish between 'own content' and 'any content', as node permissions do. This means that if someone has permission to use content moderation to publish content they can do it for any content, but the use case here is to restrict certain roles to only publishing their own content.

This seems like it would be a common requirement, but I can't find any contributed modules that do this.

I can think of a number of ways of addressing this issue.

1. Patch core. Create an issue on drupal.org for this and add a patch for the core Content Moderation module. This could be quite an easy way to get the minimal functionality working, but would be a lot of work to get it in a state where others would use it. If others didn't adopt it, it would require maintaining the patch as Drupal evolves.
2. Add the minimal set of permissions and functionality to the Workflows module. The best way to do this would require some further research into how content moderation does stuff as my current knowledge of this is not great. It might be possible to hack this functionality in with a bunch of hooks and form alters, but the better way would be to some how override the current permission system; I came across Group Content Moderation which adds this sort of functionality to group content and could provide an example of how best to do this.
3. Create a custom module on drupal.org providing this functionality. This is like option 2, but making it more generic and might be the best solution, but will likely require the most up front work.

@Adnan-cds @andybroomfield @ekes @finnlewis Any thoughts on how to proceed with this? I'm sure there are other potential solutions to those I have outlined

[finnlewis]

Quick note: the content lifecycle working group met at which @davidsiddall mentioned that this is a priority for Waltham Forest.

[finnlewis]

@ekes @andybroomfield @finnlewis any thoughts?

[finnlewis]

I think option 3 is best.

Is there really no contrib out there already.... ?

[finnlewis]

This is still quite confusing.

I ran through the user tests, and confirm that

1. Contributor creates content X.
2. Author cannot edit content X.

Unless the author has the 'edit any [service page]' permission, in which case they can also publish the node.

After reading this https://www.zivtech.com/blog/drupal-8-content-moderation-tips-tricks

I tried creating a transition that is 'review to review' to allow us to grant that permission to a given role .

No dice:

Error message
The transition from Review to Review already exists. 

Not that I can see that transition anywhere.

Further reading took me to https://www.drupal.org/project/drupal/issues/2850549 and https://www.drupal.org/project/drupal/issues/2830584 which look related and also a bit stale.

I was then looking at the contributed module https://www.drupal.org/project/workflow and reading this:

https://www.digitalnadeem.com/2020/05/09/how-to-configure-workflow-contributed-module-in-drupal/

Which begs the question, might we have backed the wrong horse by using Drupal core workflows rather than the contrib? I don't think so, but it seems we need to do some more work to allow the permissions we want.

So, firstly, any ideas why we see transition from Review to Review already exists when it is not visible in the UI?

[finnlewis]

So, firstly, any ideas why we see transition from Review to Review already exists when it is not visible in the UI?

I see why this is, there is already a transition that includes Review to Review.

I tried separating this out but it did not help.

I did read this though: https://www.drupal.org/project/drupal/issues/2845112 which is interesting. The idea that we should be able to have multiple transitions that include the same state to state transition.

[stephen-cox]

This module does a similar thing (https://www.drupal.org/project/content_moderation_permissions) so I'm looking at using it as a starting point.

[stephen-cox]

I have something almost working: https://github.com/localgovdrupal/content_moderation_owner_permissions

Permissions can be set and the UI updates, but it's not possible to publish something when you have the Editorial workflow: Use Publish transition for own content. permission. So needs some work, but am hopeful this is the right direction.

[stephen-cox]

There's now a module on drupal.org that adds this permission; https://www.drupal.org/project/content_moderation_owner_permissions

The module needs tests and documentation. Please test it. I'm happy to add others as maintainers if they wish to commit code.

Install it with: composer require drupal/content_moderation_owner_permissions:1.x-dev

[finnlewis]

Nice work @stephen-cox - maybe add me and Ekes at least as co-maintainers for now, in case we need to make any changes while you're away but also for general spreading the load.

[stephen-cox]

@finnlewis @ekes you are now both maintainers of https://www.drupal.org/project/content_moderation_owner_permissions

[stephen-cox]

@davidsiddall There's a module on drupal.org that should solve the problem here: https://www.drupal.org/project/content_moderation_owner_permissions

If you install and enable it you should then be able to set permissions to allow Authors to edit any content, but only publish their own content.

Please let me know how you get on with this and if you need help or run into any issues.

[davidsiddall]

Tagging in @Boosmith to this.

[Boosmith]

Hi @stephen-cox

Quick question about permissions for the content_moderation_owner_permissions. How should these be set? At the moment they are all blank after install.

[stephen-cox]

@Boosmith I have updated the module documentation to provide some guidance on this: https://www.drupal.org/project/content_moderation_owner_permissions

To allow an author to only publish their own content you need to give that author the 'Editorial workflow: Use Publish transition for own content.' permission and ensure they don't have the 'Editorial workflow: Use Publish transition.' permission.

You may also need to give authors the 'Edit any content' for all content types.

[stephen-cox]

Closing this as there's a module implementing this: https://www.drupal.org/project/content_moderation_owner_permissions