Re: Re: Need advice on a security model, please.
> I think Tiki's permission model is hierarchical. When you grant tiki_p_edit to the Customer group, you are giving edit permission to all default (i.e., uncategorized) wiki pages expect those that you specifically deny).
That's my understanding, too.
> You may have to assign permissions on a page-by-page basis. How many pages do you have?
I have no particular number at this stage but having to do each one individually isn't scalable thus isn't desirable.
> Or you could create categories for everything — making sure that you have no uncategorized pages (since Customers, or anyone with tiki_p_edit) would be able to edit the uncategorized pages.
Well I was planning on using categories for each section, that's not a big problem. What I think I'll run into though, is that if I give tiki_p_edit to anyone, it entitles them to edit anything they can view. That is the problem. it would mean that I can't have one group of pages read-only to a particular user and another group editable to the same user.
In other words, the only permission on a category is "Can see this category". To give edit, I need to give it at the group level and thus you can edit anything you can see.