Post permissions

[ErisDS]

Opening this up a separate issue as there is an extra piece of work here.

Here's the post permissions table:

Posts

Special Rules:

• Visibility of posts is determined based on status
• Ownership of posts is based on the author property, not created_by. The post's owner has all rights regardless of role.

API Method	Admin	Editor	Author	NoAuth
browse	y	y	y (status == published or author == self)	y (status == published)
read	y	y	y (status == published or author == self)	y (status == published)
edit	y	y	y (author == self)
add	y	y	y
destroy	y	y	y (author == self)

The resulting post config needs to look like:

"post": [
    {
        "name": "Browse posts",
        "action_type": "browse"
    },
    {
        "name": "Read posts",
        "action_type": "read"
    },
    {
        "name": "Edit posts",
        "action_type": "edit"
    },
    {
        "name": "Add posts",
        "action_type": "add"
    },
    {
        "name": "Delete posts",
        "action_type": "destroy"
    }
],
...
"permissions_roles": {
    "Administrator": {
        "db": "all"
    },
    "Editor": {
        "post": "all"
    },
    "Author": {
        "post": "all"
    }
},

The existing post permissions config looks like this:

"post": [
    {
        "name": "Edit posts",
        "action_type": "edit"
    },
    {
        "name": "Remove posts",
        "action_type": "remove"
    },
    {
        "name": "Create posts",
        "action_type": "create"
    }
],
...
"permissions_roles": {
        "Administrator": {
            "post": "all",
        },
        "Editor": {
            "post": "all",
        },
        "Author": {
            "post": ["add"],
        }
}

So this needs amending, browse & read need better handling and we need to be sure that there are full tests for all of the different cases.

[ErisDS]

I have done part of this issue. What is outstanding is:

browse & read need better handling and we need to be sure that there are full tests for all of the different cases.

Not sure about browse and read handling for 0.5, I think this should be punted to 0.5.x and deal with it across all resources.

However, improving test coverage for the Post API is still desired for 0.5

[ErisDS]

Labelling all the open permissions related issues (there are several) with both permissions and later as I'm working on a spec to solve the immediate issues as well as a long term plan, which will replace all of these issues.