Set default roles to match Plone's simpleworkflow to enforce review before publish

[djay]

Based discussion https://community.plone.org/t/changing-the-workflow-for-iterate/5619/11 a few things about working copy doesn't work as expected.

If you want to enforce review before publish in Plone you use the roles Contributor and Reviewer. Owner by default can't edit existing content without revoking it. Only Editor and Admin can edit it live.

However currently if you install Working Copy then Owners can checkout and then check back in. Also Contributors can't checkout or checkin. I propose the following.

• Contributors: Give checkout access only
• Reviewers: Give checkin access only
• Editors: Keep the same since they can edit live anyway. But you could argue if you are installing iterate then you should be removing the ability of editors to edit live?
• Owners: Give checkin access only.

This means workflow for a copy would work as you would expect. Owners and contributors have to checkout to suggest a change and only reviewers or site admins can checkin after a review.

A related change to further make it less confusing would be integrate workflow and working copy. People expect working copy to be a part of the workflow. They don't expect to look at the actions menu.

• Make publish on a copy automatically checkin and redirect to the baseline
• Make a new "checkout" transition that goes from publish to publish that results in a checkout.

Since someone might have custom workflow this would need to be done in a generic way so that it could work with anyones custom workflow. I'd suggest on installing Working copy creating two content rules that are designed to work with SimpleWorkflow but could be adapted to work with other workflows. It might be wise to also hide the checkin and checkout options or have a setting to do this.

[mauritsvanrees]

What would make sense to me, is:

• Contributors: no checkout/checkin. With Iterate you change the edit process, not the add process.
• Reviewers: only checkin.
• Editors: only checkout. With Iterate, Editors should not be able to edit live.
• Owners: only checkout.

It may make sense to have a separate workflow in Iterate that is more strict like this, especially for editors. Your suggestions may work there too. Installing Iterate could set this as the default workflow.

I may be stupid for never using contentrules, but I wouldn't expect this to be arranged using them.

Maybe add a control panel where admins can tweak this a bit. This would be analogous to the discussions control panel, where some of the settings result in a change of the workflow, or a change in the general permission settings.

[djay]

I can see your point but it does change the meaning of the roles in plone without iterate. Editors have the ability to edit without review and to edit published items. It doesnt make sense to be more strict with them with iterate. It would only make sense if you redefined what an Editor role does outside of iterate and removed the ability to edit published documents. But then you have lost that role to give people that ability. Contributor role only really exists so their work can be reviewed. Giving them checkout right is giving them the ability to edit other peoples pages but only if they are reviewed so I think thats OK. The only other way around this would be to add a new role of Suggesters who are able to checkout but not checkin or add. That would give the most flexibility but I wonder if its overkill. The suggestion around content rules is better done in a different ticket. Its about not having checking checkout be in the actions menu but linked to workflow states instead.

…

On Fri, 2 Feb 2018, 8:27 PM Maurits van Rees ***@***.***> wrote: What would make sense to me, is: - Contributors: *no* checkout/checkin. With Iterate you change the edit process, not the add process. - Reviewers: only checkin. - Editors: only checkout. With Iterate, Editors should not be able to edit live. - Owners: only checkout. It may make sense to have a separate workflow in Iterate that is more strict like this, especially for editors. Your suggestions may work there too. Installing Iterate could set this as the default workflow. I may be stupid for never using contentrules, but I wouldn't expect this to be arranged using them. *Maybe* add a control panel where admins can tweak this a bit. This would be analogous to the discussions control panel, where some of the settings result in a change of the workflow, or a change in the general permission settings. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#59 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AACi5PluVq5vCESShAywmvUeHUJOb8oGks5tQw1WgaJpZM4R2o7m> .

[djay]

It comes down to this. How many times would you not want someone who can add a page to also not be able to suggest changes to that OE other page?

…

On Fri, 2 Feb 2018, 9:23 PM Dylan Jay ***@***.***> wrote: I can see your point but it does change the meaning of the roles in plone without iterate. Editors have the ability to edit without review and to edit published items. It doesnt make sense to be more strict with them with iterate. It would only make sense if you redefined what an Editor role does outside of iterate and removed the ability to edit published documents. But then you have lost that role to give people that ability. Contributor role only really exists so their work can be reviewed. Giving them checkout right is giving them the ability to edit other peoples pages but only if they are reviewed so I think thats OK. The only other way around this would be to add a new role of Suggesters who are able to checkout but not checkin or add. That would give the most flexibility but I wonder if its overkill. The suggestion around content rules is better done in a different ticket. Its about not having checking checkout be in the actions menu but linked to workflow states instead. On Fri, 2 Feb 2018, 8:27 PM Maurits van Rees ***@***.***> wrote: > What would make sense to me, is: > > - Contributors: *no* checkout/checkin. With Iterate you change the > edit process, not the add process. > - Reviewers: only checkin. > - Editors: only checkout. With Iterate, Editors should not be able to > edit live. > - Owners: only checkout. > > It may make sense to have a separate workflow in Iterate that is more > strict like this, especially for editors. Your suggestions may work there > too. Installing Iterate could set this as the default workflow. > > I may be stupid for never using contentrules, but I wouldn't expect this > to be arranged using them. > > *Maybe* add a control panel where admins can tweak this a bit. This > would be analogous to the discussions control panel, where some of the > settings result in a change of the workflow, or a change in the general > permission settings. > > — > You are receiving this because you authored the thread. > Reply to this email directly, view it on GitHub > <#59 (comment)>, > or mute the thread > <https://github.com/notifications/unsubscribe-auth/AACi5PluVq5vCESShAywmvUeHUJOb8oGks5tQw1WgaJpZM4R2o7m> > . >

[mauritsvanrees]

Okay, I am fine with Contributors suggesting changes. With this, they create a new document, which just happens to be linked to another document. So checkout for them would be good.

But for editors: to me, Iterate is about giving Reviewers a bigger role. If Editors can then bypass the Reviewers by continuing to edit published documents by checking it out and in, then Iterate loses much of its value. Well, it is then still useful as a way of trying out changes to a document before putting it live.

[djay]

@mauritsvanrees So options for editors and enforcing review are either

1. On install of iterate, remove Editors ability to edit live. They only have checkout option. And become the same as Contributors. Ensure editors know they now have to use checkout instead of "edit".
2. Just don't give anyone Editors role. Somehow make sure the admin who installs Iterate is aware that Editors can edit live still and that if they want to prevent that they have to move everyone out of Editors into Contributors.

Neither option is great :( I can see pros and cons on each side.

[rpatterson]

Will someone review #68?