ftw.lawgiver 1.17.5

Registering permissions to an action group

The registration of a permission to an action group should be done in the package where the permission is defined. This allows to keep changes of the permissions and action group registrations together in branches, for reviews etc. ftw.lawgiver already assigns default Plone / Zope permissions to action groups.

The registration is done in ZCML. Here is an example lawgiver.zcml:

<configure
    xmlns="http://namespaces.zope.org/zope"
    xmlns:lawgiver="http://namespaces.zope.org/lawgiver"
    i18n_domain="my.package">

    <include package="ftw.lawgiver" />

    <lawgiver:map_permissions
        action_group="add"
        permissions="my.package: Add Foo,
                     my.package: Add Bar"
        />

</configure>

If you define multiple permissions in the same map_permissions directive make sure to separate them by comma.

By putting the ZCML in a separate lawgiver.zcml file you can define lawgiver in your addon package without having to define a dependency on ftw.lawgiver by using zcml:condition while loading it in your default configure.zcml:

<configure
    xmlns="http://namespaces.zope.org/zope"
    xmlns:zcml="http://namespaces.zope.org/zcml"
    i18n_domain="my.package">

    <include zcml:condition="installed ftw.lawgiver" file="lawgiver.zcml" />

</configure>

Overriding action groups

Maybe the permission to action group mapping does not work well for a specific workflow and you would like to change to mapping for this workflow only.

This can be easily achieved by also defining the workflow in the ZCML:

<configure
    xmlns="http://namespaces.zope.org/zope"
    xmlns:lawgiver="http://namespaces.zope.org/lawgiver"
    i18n_domain="my.package">

    <include package="ftw.lawgiver" />

    <lawgiver:map_permissions
        action_group="add"
        permissions="my.package: Add Foo,
                     my.package: Add Bar"
        workflow="my_workflow"
        />

</configure>

Assigning permission to multiple action groups

Sometimes, a permission should be assigned to multiple action groups. This can be done with the move attribute of the map_permissions directive. Just make sure that all other map_permissions ZCMLs are loaded before doing that, especially the default lawgiver.zcml of ftw.lawgiver.

<configure
    xmlns="http://namespaces.zope.org/zope"
    xmlns:lawgiver="http://namespaces.zope.org/lawgiver"
    i18n_domain="my.package">

    <include package="ftw.lawgiver" />

    <lawgiver:map_permissions
        action_group="add"
        permissions="Add portal content"
        />

    <lawgiver:map_permissions
        action_group="add ticket"
        permissions="my.package: Add Ticket"
        workflow="my_workflow"
        />

    <!-- We want to have "Add portal content" in the "add ticket" action group too,
         but we should not remove it from "add".
         By using move="False" we can add "Add portal content" to "add ticket" without
         removing it from "add".
         /-->

    <lawgiver:map_permissions
        action_group="add ticket"
        permissions="Add portal content"
        workflow="my_workflow"
        move="False"
        />

</configure>

Workflow scope

The lawgiver:workflow directive can be used to group multiple statements and apply them to a specific workflow.

<configure
    xmlns="http://namespaces.zope.org/zope"
    xmlns:lawgiver="http://namespaces.zope.org/lawgiver"
    i18n_domain="my.package">

  <include package="ftw.lawgiver" />

  <lawgiver:workflow name="the-workflow">

    <lawgiver:map_permissions
        action_group="add folder"
        permissions="Add folder"
        />

    <lawgiver:ignore
        permissions="ATContentTypes: View history"
        />

  </lawgiver:workflow>

</configure>

States and transitions

The states and transitions are defined in simple lists:

[My Custom Workflow]
Description: A three state publication workflow
Initial Status: Private

Status Private:

Status Pending:

Status Published:

Transitions:
  Publish (Private => Published)
  Submit for publication (Private => Pending)
  Reject (Pending => Private)
  Retract (Pending => Private)
  Publish (Pending => Published)
  Reject (Published => Private)

We are not using any internal ids for workflow states or transitions. Instead, we use the same labels which the user will actually see–the ids are automatically generated by ftw.lawgiver.

Role mapping

In Plone we have a given set of rather technical roles (e.g. Editor, Contributor, Reader) which may not apply for all use cases in real life. The customer may have own roles with different names. Since the existing roles are already well established in Plone it is usually not a good thing to add new roles to Plone. It is better to try to reuse the existing roles.

Because the customer has different labels for his roles we need to map customer roles to Plone roles:

Role mapping:
  editor-in-chief => Reviewer
  editor => Editor
  everyone => Anonymous

In our example we have only “normal” editors and an “editor-in-chief” who can review and publish the contents. We do not have to use the Contributor role since our editors can edit, add new content, and request a review for existing content. Therefore, it is not necessary to distinguish Editor and Contributor role.

Transition-guard expressions

Transition-guard expressions is a way to hide your transitions dynamically, in addition to the guard-roles. Use the options-syntax to define a guard-expression.

Expressions in DCWorkflow are TALES expressions. To see the contexts available in expressions, take a look at portal_workflow/[your-workflow-id]/guardExprDocs

Warning: Transition-guard expressions do not protect the transition itself. If the user knows the URL to perform the transition, it will pass. It only hides the transition from the user.

[My Custom Workflow]
Initial Status: Private

Status Private:
Status Published:

Transitions:
  Publish (Private => Published) [guard-expression => python:here.guard(state_change)]
  Reject (Published => Private) [guard-expression => here/guard_reject]

General statements

Usually there are some general statements, for example that a user with the Adminstrator role can always edit the contents in any workflow state. Such statements should not be repeated for every state but defined once as a general statement.

An example:

General:
  An administrator can always view the content
  An administrator can always edit the content
  An administrator can always delete the content

These general statements apply for all states.

Describing states

For each state we describe the actions a user with a certain role can perform. We follow the principle that any user / role is NOT allowed do anything by default, we have to explicitly list every action he will be allowed to perform.

Status Private:
  An editor can view this content.
  An editor can edit this content.
  An editor can delete this content.
  An editor can add new content.
  An editor can submit for publication.
  An editor-in-chief can view this content.
  An editor-in-chief can edit this content.
  An editor-in-chief can delete this content.
  An editor-in-chief can add new content.
  An editor-in-chief can publish this content.

Status Pending:
  An editor can view this content.
  An editor can add new content.
  An editor can retract this content.
  An editor-in-chief can view this content.
  An editor-in-chief can edit this content.
  An editor-in-chief can delete this content.
  An editor-in-chief can add new content.
  An editor-in-chief can publish this content.
  An editor-in-chief can reject this content.

Status Published:
  An editor can view this content.
  An editor can add new content.
  An editor can retract this content.
  An editor-in-chief can view this content.
  An editor-in-chief can add new content.
  An editor-in-chief can retract this content.
  Anyone can view this content.

Role inheritance

Roles can be inherited from other roles, globally and for a single status:

[Role Inheritance Workflow]
Initial Status: Foo

Role mapping:
  editor => Editor
  editor-in-chief => Reviewer
  administrator => Site Administrator

General:
  An administrator can always perform the same actions as an editor.
  An administrator can always perform the same actions as an editor-in-chief.

Status Foo:
  An editor-in-chief can perform the same actions as an editor.
  An editor can view this content.
  An editor can edit this content.

Status Bar:
  An editor can view this content.
  An editor-in-chief can view this content.
  An editor-in-chief can edit this content.

Worklists

Worklists are automatically generated for you when you grant access to the worklist:

[A workflow]
...

Status Pending:
  An editor-in-chief can access the worklist.

Those “can access the worklist” statements do not work in the “General” section, they need to be defined a “Status” section.

For each status with “can access the worklist” statements a worklist is generated, guarded with the role for which there is a statement.

Workflow specification discovery

All workflow directories in registered generic setup profiles are automatically scanned for workflow specifications. Just place a specification.txt in a workflow directory and ftw.lawgiver will discover it automatically.

Example paths:

• Specification: profiles/default/workflows/my_custom_workflow/specification.txt

• Workflow XML: profiles/default/workflows/my_custom_workflow/definition.txt

In this example it is assumed that profiles/default is a registered generic setup profile directory.

Changing Transition URLs

Sometimes the transition URLs need to point to another view. This can be achieved by using the transition-url option, where a string can be passed which will then be substituted with the transition id. Be sure to use a double %% for parts which should not be replaced when generating the workflow, such as the %%(content_url)s.

Example:

transition-url = %%(content_url)s/custom_wf_action?workflow_action=%(transition)s

Languages

Currently supported languages:

English (default)

• Filename: specification.txt

• Example: ftw/lawgiver/tests/assets/languages/specification.txt

German

• Filename: specification.de.txt

• Example: ftw/lawgiver/tests/assets/languages/specification.de.txt

Contributing new languages

We happily accept pull requests with new languages!

Creating a new language is as simple:

• Create a new specification example in ftw/lawgiver/tests/assets/languages/, implementing the same workflow as specification.txt.

• Run the tests with bin/test. It should fail at this point. Keep running them after each change.

• Add a new language module to ftw/lawgiver/wdl/languages/.

• Register the new language in ftw/lawgiver/wdl/languages/__init__.py.

• Implement the language specific constraints and extraction methods in your new language class until all tests pass.

• Add the language to the readme.

• Send us a pull request!

Updating translations

The button Update translations in locales directory in the workflow details view helps you keep your translations up to date. It writes directly to the locales directory on your machine.

When updating the translations, these files are written:

• your/package/locales/plone.pot

• your/package/locales/en/LC_MESSAGES/plone.po

When updating the messages in your locales file, all no longer valid messages which start with the workflow ID prefix are removed automatically.

Roles in sharing view

By default the @@sharing view lists some default Plone roles:

• Can add (Contributor)

• Can edit (Editor)

• Can review (Reviewer)

• Can view (Reader)

Often the workflow does not use all of those roles, or uses different ones. Lawgiver allows you to configure which roles are showing up in at the sharing view. If your users are granting roles on the @@sharing view, you should probably configure the roles so that they have meanigful names and only the relevant ones are listed.

If you want to customize the displayed roles for your workflow, you can do this right in your workflow specification:

[A workflow]

Role mapping:
  editor => Editor
  editor-in-chief => Reviewer
  administrator => Site Administrator

Visible roles:
  editor
  editor-in-chief

The lawgiver then sets the permissions required for managing a role correctly. This works for registered roles. Plone only registers Contributor, Editor, Reviewer and Reader by default. See the Registering additional roles section.

Translating the roles

The lawgiver extends Plone’s role translation system so that the roles in the @@sharing view can be translated per workflow.

This is done through the Plone standard role utilites, allowing addon tools to also use the corrent role translation without the need of customization.

The lawgiver provides example translations (plone.pot / plone.po) in the lawgiver control panel, which can easily be copied to your local plone translations (locales). These translations also include role translations and can be modified to your needs.

The lawgiver automatically looks up the right translation of the roles, depending on your workflow.

Registering additional roles

You can easily register custom roles or Plone default roles which are not visible by default (such as Site Manager).

Use the lawgiver directive for registering new roles:

<configure
    xmlns="http://namespaces.zope.org/zope"
    xmlns:lawgiver="http://namespaces.zope.org/lawgiver"
    i18n_domain="my.package">

    <include package="ftw.lawgiver" />

    <lawgiver:role name="Site Manager" />

</configure>

The lawgiver:role directive does all the required things for you, such as registering the permission in zope, mapping the permission to the default lawgiver manage security action group and registering the required utility and adapter.

Optional arguments:

• permission: the required permission for granting this role. The permission is automatically generated as Sharing page: Delegate [ROLE] role.

• register_permission: automatically registers the permissions in Zope. This is True by default.

• map_permission: automatically map the permission to the default lawgiver manage security action group. Lawgiver will also re-map the permission according to your Visible roles configuration in the workflow specification.

Description of roles in sharing view

ftw.lawgiver automatically registers an overlay when clicking on the role text in the table header on the sharing view. The overlay displays a description of what this role can do in each state of the current workflow:

[A workflow]

Role mapping:
  editor => Editor
  editor-in-chief => Reviewer
  administrator => Site Administrator

editor-in-chief role description:
  The editor-in-chief reviews and publishes content.

Example

1. Implement a custom view with custom behavior:

   from ftw.lawgiver.browser.modifystatus import ModifyStatusViewBase
   
   class WebModifyStatus(ModifyStatusViewBase):
   
       @ModifyStatusViewBase.intercept('web--TRANSITION--publish--draft-published')
       def verify_on_publish(self, context, transition):
           # verify things
           return self.redirect_to_content_status_modify(context, transition)

   The default behavior for not intercepted transitions is to redirect to the default content_status_modify script, which is the default behavior of Plone. The default behavior is implemented with the redirect_to_content_status_modify, so the example above also falls back to the default behavior.

   The base class provides functionality as methods:

   • execute_transition(context, transition, **kwargs): executes the content_status_modify script in-line, so that we can later change the redirect or do more things in the same transaction.

   • redirect_to_content_status_modify(context, transaction): redirects the browser the the content_status_modify script. The script is not executed in the same transaction.

   • set_workflow_state(context, review_state, **infos): changes the workflow state of the context without executing a transition or respecting any guards.

   • in_state(context, review_state): context manager for temporarily switching the review state.

   • redirect_to(context): redirects to the absolute url of the context.

2. Register the view in ZCML:

   <browser:page
       name="web-modify-status"
       for="*"
       class=".modifystatus.WebModifyStatus"
       permission="zope2.View"
       />

3. Configure the lawgiver workflow to use the this view as action:

   # Settings
   transition-url = %%(content_url)s/@@web-modify-status?transition=%(transition)s