Simple workflow issues

[migueletto]

Hello,

I am playing with simple workflows in Alfresco Community 2.1, and have hit some issues. The scenario I have is:
I have two user groups A and B and three spaces: Draft, Approving and Approved. The (very simple) workflow I tried to configure is:

1. Group A posts a document do Draft (and possibly edit it many times until it is ready).
2. Group A selects a workflow action of an existing document in Draft and it is moved to Approving.
3. Group B selects a workflow action of an existing document in Approving and it is moved to Approved.
Restrictions:
4. Group A cannot directly post/remove documents to/from Approving or Approved.
5. Group B cannot directly post/remove documents to/from Draft, Approving or Approved.

The only way I found to satisfy 1 and 2 is to setup group A as "contributor" to both Draft and Approving. But that violates 4, because now A can post and remove documents to/from Approving. Similar problems arouse with group B.

Is there a way to implement this restrictions using simple workflow ?

Thanks,
Marcio.

[liao1108]

it seems that space rule is executed by current userr who put file into, not by background system itself. If it's true, there is no way to make a chain effect ( A invoke B, and B invoke C then) to make job more loosely couple, that's quite a pity for Alfresco.

Not to violate the space permission and achieve move and invoke rule freely, i think you can try adding an custom action (usually by java program) with administrator authority to do anything inside it's session period, it acts as a bridge object to link any space and rule together.

[migueletto]

Thanks for the information. Is there any documentation on how to write custom actions (Java knowledge is not a problem) ? Do custom actions always run with system privileges ?

I also remember reading somewhere that when a rule is executed in background, it runs with system privileges (is this true ??). So I created a rule to run a script (the backup.js example script) to move a document to a restricted folder, but it silently failed. I assume it failed because of lack of privileges, since the logged in user does not have permission to write to the destination folder, and it seems the rule did not run with system privileges.

The permission system in Alfresco is turning a little frustating for me. Maybe I am trying to implement something Alfresco was not designed for. What I really wanted to do is: forcing users to move documents from one space to other only through workflow actions, and not allowing them to manually remove anything from there.

Regards,
Marcio.

[liao1108]

It would take long time to adjust Alfresco security and permission. Spaces in Alfresco play the same role as Folder in Operation System, if a folder owned by you, you would do anything you want, you can create child, share to someone, define rule in the back…., the design philosophy for rule, i think, is different to stored procedure in RDBMS. If you are going to make them act as stored procedure(always run as system administrator), you have to re-arrange all equiped system behavior, it's terrible.

I found Script in Workflow could be run as 'admin', that may solve lots of problem, but is's only available in version 2.9, i am still evaluating it.

Leo