[Zope-PTK] Re: PTK security

[Shane Hathaway]

Fabio Forno wrote:
> 
> Shane Hathaway wrote:
> >
> > >     2. security and catalog was changed after portalcontent state
> > > changed . and It all done by system automatically.
> >
> > That's right, and that's what we need to look at now.  The old method
> > was strange, but it worked.  See previous postings for details.
> >
> 
> I've thougth a bit about it. If we want to keep the Zope securiy
> mechanism, the only way is to keep private content and published content
> in separate trees, with the latter having also the Anynonous (or Member
> or whatever you want) role with the view permission. Each time an item
> gets published it is copied authomatically into the public area and
> catalogued. Then, each time the domunt state is changed the two copies
> will have different modidications, accordingly to the roles of the
> modifier:
> 
> - the document is changed by a contributor without the Reviewer Role:
> the published copy remains unchanged and it is synvhronized opnly when a
> Reviewer grants the content
> - the document is changed by a contributor with the Reviewer Role: both
> copies remains synchronized with the new content
> - Then all ather changes (deletion, change of publishing state, i.e made
> private again) could be granted to all contributors and reflected also
> to the published copy, or only to a Reviewer accordingly to the chosen
> policy.
>
> In this moment with this approach I see only one problem. For reviewers
> and owners the documents are catalogued twice, but I think It could be
> possible to filter them easily

Do you see any drawbacks to simply making it so that the item is moved
rather than copied upon putting it in the "published" state?  The
obvious problem is that when the user clicks the "publish" radio button
the object gets moved without any warning.  However, that is only a UI
issue: if we changed the UI so that the "published" state can only be
activated by pushing a separate button with some instructions, it would
be quite clear what's going on.

Shane