This is second oldest thread in the Roadmap category, created on the 30th Jan 2022. In three weeks its going to be two years old. But there's a good chance new permissions system will be merged in the main branch of Misago before this happens.
Just though its nice to point out how those foundational changes are now happening one after the other after years of stagnation :)
I would have no criticism of the pace of misago development. It's already good, and I use it as preference to other forum options. I've taken the first tentative steps towards learning django and python, with a hope to doing some of my first coding for 30 years. I hope to contribute more, and perhaps look at some plugins. Unfortunately my maintenance and infrastructure commitments are always going to be a limiting factor.
Here's a permissions table:
I still have to work out how to display categories tree structure on this screen. And clean up the code. And write tests. But after I do that, I'll have just two more things to do: make admin UI for setting moderators, and build permissions object from user's groups - something I've already did for v4.
Fingers crossed, new permissions framework will be merged early next week. 🥹
Final version of perms table:
@rafalp User can upload file up to (x)mb. Do you plan to have permission to download/view attached files? Groups can be given their own file upload limit?
"Attachments" permission is a permission to upload and download files within a category. Upload permission and file limit will be set per site on the user groups, so it will be possible to configure that members will be able to upload files up to 2mb, but admins and mods will be able to upload files up to 6mb.
This took me a while, but permissions data model and the admin panel changes are completed. Moving on to building user permissions objects. When thats finished, it will be few cleanups and then merge.
New user permissions framework has been merged 😎
Currently, only non-category permission in new framework is "can see user profiles" - I'll add other permissions as I work through Misago's views, removing the React.js from them and adding HTMX here and there. This is a big task to do that I am expecting to spend rest of Q1 on it. But as I've said, its well worth doing.
Question: Does your new user permission framework allow restrict specific user(s) or user groups rights, compared to generic member ones? Current framework does not, but as you stated "users do not need to belong to members group" for new one, then maybe that has changed?
Reason: We may sometimes have need to restrict some user activity, like prohibiting him posting on some categories, decrease hourly post limit, require posts approval and other mild limitations. Or - make some users not to see generally visible part of forum - this was real idea, but impossible to implement.
Yes. In new systen you can create a new „restricted” members group and make it a group for some users instead of members group (or any other default group).
Furthermore, a lot of permission checks are wired in to the plugin system, so you can write plugins with extra checks that are not possible in standard, eg. deny user a posting permission in a specified thread.
Thank you for clarification!
