topic Re: Why aren't rules run with 'highest permissions'? in Alfresco Archive

Why aren't rules run with 'highest permissions'?

fx3000se — Tue, 17 Feb 2009 13:18:26 GMT

Related to this topic: http://forums.alfresco.com/en/viewtopic.php?f=9&t=16666#p55979If the rules were run with "highest permissions" (or if the rules would ignore the permissions) the problem in the topic would not exist…

Re: Why aren't rules run with 'highest permissions'?

loftux — Tue, 17 Feb 2009 14:59:12 GMT

If the rules were run with "highest permissions" (or if the rules would ignore the permissions) the problem in the topic would not exist…

But that would not be such a great idea, would it?
You can achieve that by giving everyone full access from Company Home and below, now a rule would not fail because of permissions.
But then you say, they should not be able to delete, or move, update properties, or take other actions on documents. Fine, that is what permissions are for. But then why would you allow this with rules?

Have a look at http://wiki.alfresco.com/wiki/3.0_JavaScript_API and setOwner, as the owner (who always have full rights) of a document you can assign ownership to lets say admin with a script based rule, and remove the permissions for the current user.
If that is what you want to achieve.

Re: Why aren't rules run with 'highest permissions'?

fx3000se — Tue, 17 Feb 2009 15:18:25 GMT

You can achieve that by giving everyone full access from Company Home and below, now a rule would not fail because of permissions.

You are wrong. The "postbox" is open to everyone the "inbox" only to the "boss". As the rule is run as everyone or any other user account, the rule is not able to move the document into the "inbox".
Maybe "scheduled actions" can solve this problem?

Re: Why aren't rules run with 'highest permissions'?

loftux — Tue, 17 Feb 2009 15:47:12 GMT

I would say I am right
If inbox is not open to everyone, one should not be allowed to move things there, right?
Instead
1. Put document in Postbox. Have Collaborator permissions on space
2. With script rule, move to inbox, users have Contributor rights to this space
2.1 In script: remove permissions, setInheritsPermissions(boolean inherit)
2.2 In script: set new owner equal to "boss" with setOwner(String userId)
2.2 Optionally give specific permissions to boss or other users

That should do what you want.