Introduction

The purpose of this plugin is to provide eWiki with a means of handling access permissions for all of its pages, based on users and groups. Permissions are set as a ring level (comparable to eWiki access rings) for a right and pagename combination. Rights are associated with group names, which may then contain users. For all intensive purposes, rights and groups function as a pair of one entity; the right being associated with the page permissions and the group being associated with users.

When a user accesses a page, his highest available ring level for the page is calculated based on all group memberships, and that level is used to denote what actions may be performed on that page. eWiki actions may be mapped to one of these base ring levels, so that page permissions may also be used to govern custom actions for other plugings (to a degree). The available base levels are as follows:

• view
• forum (write page comments)
• edit (edit a page)
• manage (advanced editing, such as modifying a page's permissions)
• admin

There are several rights/groups constructed by the plugin by default, which have reserved used. These are listed below:

• *NotLoggedIn
• *LoggedIn
• *LW_Publisher
• *LW_Admin

The *NotLoggedIn and *LoggedIn groups are used to signify the generic class of unauthenticated and logged-in users, respectively. The group of *NotLoggedIn is also a superset of the group of *LoggedIn users, so that permissions satisfied by unauthenticated users will also be satisfied by logged-in users; however, the opposite does not hold. Members of the *LW_Publisher that already have the rights to edit an eWiki page will also be able to make that page publicly viewable by members of the *NotLoggedIn group. Note that a member of the *LW_Publisher group still requires the fundamental edit rights on a pagename first. Lastly, the *LW_Admin group is given access to the plugin's administration pages by default, allowing a member of this group to modify page permissions, user accounts, and rights/groups.

This plugin uses several eWiki plugin hooks. The following eWiki plugin pagenames are reserved:

• *LogIn
• *LogOut
• *ChangePassword
• *AdminAddUsers (administration interfaces)
• *AdminPerms
• *AdminRights
• *AdminUsers

The following authentication hooks are made:

• $ewiki_plugins['auth_query'][0] for querying logged-in user status
• $ewiki_plugins['auth_perm'][0] for querying a page permission

In order the handle page permissions, the eWiki edit-page form is appended with form components to manage the page permissions and toggle the 'published' status of a page, which allows it to be viewed by users that are not logged in. Two plugin callbacks are added to each of the following hooks:

• $ewiki_plugins['edit_form_append'][]
• $ewiki_plugins['edit_save'][]