I am pretty sure the answer here is going to be "don't do that" but I'm curious if anyone has thought about this. Let's say you have root level folders A, B, and C. I want the people with a certain local role on set(A, B) to have a certain permission on C. There is no Zope acquisition between them these folders. How do I set this up?
Doing this manually, I'd create a new group, populate it with people that have certain roles from A and B, and give it the intended permission. But I want this to happen automatically, with an admin only assigning people a role on A or B.
One possibility is to put in event listeners when A or B is edited. It adds or revokes roles on C, based on roles had in A and B. Again, my gut feeling is this is antithetical to the way Zope security is laid out, and I probably should not do it. At the least there is probably some UX wonkiness. Has anyone considered a use case like this?
Why don't you use computed local roles? Assign a dedicted role reader_<x> for each folder x in A, B, C,...and then register your local role provider which can assign a reader_<x> role on the fly based on your specific constraints.
@stevepiercy The Plone 6 docs on workflow are empty Workflows — Plone Documentation v6, would it makes sense to start with porting over the docs in this 2023 training? To be honest I do not understand the philosophy behind what should go in training vs docs. But I'd be willing to submit a PR to simply copy this, and/or report back anything that needs updating if I end up implementing this ILocalRolesProvider.
https://6.docs.plone.org/ is the current authoritative version of Plone Documentation. It is actively maintained.
https://training.plone.org/ is for trainers to publish their trainings, usually for the annual Plone Conference but also for their clients. It is not authoritative documentation because the trainings seldom get updated after the conference and often become obsolete. Before each Plone Conference, the previous year's trainings get archived, remaining permanently available under [year].training.plone.org. This also helps visitors know when it was last updated and for which Plone Conference it was used, and it may help people to perform a task that is no longer supported.
There's an open issue in plone/documentation to migrate content into this section. Help would be greatly appreciated. It's OK to do, say, one page or paragraph per pull request, instead of an unmanageable blob of copy-paste. It will need to go through a technical review to ensure accuracy, and an editorial review for all the other quality bits.