Access control on events

[GoogleCodeExporter]

It would be a nice addon to have access controll enabled on the week 
calendar. So for example when an admin would create an event, he could set 
which user groups have the right to edit the event times. Or this could be 
hardcoded that events of a specific types are only editable by specific 
user groups.

One use i see for this would be when a business operates in varying hours 
depending on which day of the week it is, you could automatically generate 
these access controlled events outside the operating hours for every day, 
now the personnel in your company would not be able to create appointments 
outside the operating hours. 

Take my business for example, we normally operate 17-21 during weekdays and 
10-18 during weekends. Then we have exceptions, sometimes we operate from 
10-21 during weekdays and sometimes from 12-16 during weekdays.

I think this effect could be enabled by assigning a "required level" 
integer for each event, where the default could be 0 meaning everyone and 7 
could be admin.. Then you could leave it up to determine the level of the 
user viewing the calendar, because everyone probably has a variety of ways 
they control their user logins and sessions. 

Original issue reported on code.google.com by ted.mellin on 10 Jun 2009 at 11:30

[GoogleCodeExporter]

You could do a callback to a webservice for finding out if for instance a 
appointment
is moveable/resizeable. And same goes for adding/editing appointments. I think 
this
is not something the frontend of a system should do. But thats my opinion. 

Maybe somebody else has some other ideas. 

Original comment by Pimmetje on 10 Jun 2009 at 3:51

[GoogleCodeExporter]

I gave the problem some more thought. And i think (did not test it) it's best 
way to
add a extra element to the json file. Like dragable and resizeable. And than 
use the
dragable and resizeable methods to get the value and return the value true/false
(maybe do some calculation on time or whatever).

(This way the backend can handle it, and i think thats the bast).

Original comment by Pimmetje on 11 Jun 2009 at 11:46

[GoogleCodeExporter]

I think this should be handled in both the front and back end. Initially you 
should
restrict the access using the front end by passing back properties with the json
events based on the current user. This can then be used to determine behaviour 
in
calendar event calbacks (resize, drag etc). This of course is only a first 
layer to
control the behaviour of the front end. You'd need to also cover off the back 
end to
prevent malicious use.

I'm going to create a separate feature request to address the business hours 
problem.
For now, one way that I described to Ted by email is that you could generate
calEvents to indicate busy time that are outside of business hours. These could 
have
properties to define the way they are rendered and prevent their modification 
by users.

Original comment by robmo...@gmail.com on 15 Jun 2009 at 1:30

• Changed title: Access control on events
• Changed state: WontFix
• Added labels: Type-Enhancement
• Removed labels: Type-Defect