# Help with new rules addon for groups; Collect Ideas how to do

**URL:** <https://discourse.getcockpit.com/t/help-with-new-rules-addon-for-groups-collect-ideas-how-to-do/1995>\
**Category:** Addons\
**Created:** [July 6, 2021, 9:30pm UTC](https://discourse.getcockpit.com/t/help-with-new-rules-addon-for-groups-collect-ideas-how-to-do/1995 "2021-07-06T21:30:03Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Hackbard](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.getcockpit.com/hackbard/32/854_2.png) [@Hackbard](https://discourse.getcockpit.com/u/Hackbard)\
**Post date:** [July 6, 2021, 9:30pm UTC](https://discourse.getcockpit.com/t/help-with-new-rules-addon-for-groups-collect-ideas-how-to-do/1995/1 "2021-07-06T21:30:03Z")

</div>

Hi,

first my idea.  
Create rules for groups, that only members of a group can Read,Update,Delete ( CRUD ) the collection items.

So i’m thinking of just add new rules  
The default seems to be:  
“create” : {enabled:false},  
“read” : {enabled:false},  
“update” : {enabled:false},  
“delete” : {enabled:false}  
according to modules/Collections/views/collection.php

and i found a lot of hardcoded stuff for exactly these.  
I think i can overwrite a lot of it … but then i can fork the project and rewrite the hole permission thing.

So i think i’m in a mind trap 😉

What do you think what is the easiest way to do it?  
Or is there even a way with the collections rules ( the custom php )?

I am looking forward to an idea exchange  
Hackbard

---

<div class="post-metadata">

**Author:** ![Hackbard](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.getcockpit.com/hackbard/32/854_2.png) [@Hackbard](https://discourse.getcockpit.com/u/Hackbard)\
**Post date:** [July 6, 2021, 10:12pm UTC](https://discourse.getcockpit.com/t/help-with-new-rules-addon-for-groups-collect-ideas-how-to-do/1995/2 "2021-07-06T22:12:31Z")

</div>

Some idea i got now, is to use the trigger `collections.save.before` and save the current user group if not present. After that i should be able to check that in the custom rule files or not?

---

<div class="post-metadata">

**Author:** ![abernh](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.getcockpit.com/abernh/32/859_2.png) [@abernh](https://discourse.getcockpit.com/u/abernh)\
**Post date:** [July 7, 2021, 1:03pm UTC](https://discourse.getcockpit.com/t/help-with-new-rules-addon-for-groups-collect-ideas-how-to-do/1995/3 "2021-07-07T13:03:12Z")

</div>

I rechecked the source and the respective events should be

- collections: `collections.createcollection`
- singletons: `singleton.save.after`

The collections-event is triggered after the collection is created and there is only this one event.  
The singletons trigger a `before` and an `after` event, but for the sake of similar behavior in relation to the collection-creation-event I’d suggest to go with the `after` event.

The mentioned `collections.save.before` event is triggered before entry-save.

---

<div class="post-metadata">

**Author:** ![Hackbard](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.getcockpit.com/hackbard/32/854_2.png) [@Hackbard](https://discourse.getcockpit.com/u/Hackbard)\
**Post date:** [July 7, 2021, 9:38pm UTC](https://discourse.getcockpit.com/t/help-with-new-rules-addon-for-groups-collect-ideas-how-to-do/1995/4 "2021-07-07T21:38:14Z")

</div>

Yes i need the `collections.save.before` event so i can add the group of the current user.  
And after that i can check with the custom rules.

---

<div class="post-metadata">

**Author:** ![abernh](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.getcockpit.com/abernh/32/859_2.png) [@abernh](https://discourse.getcockpit.com/u/abernh)\
**Post date:** [July 8, 2021, 8:18am UTC](https://discourse.getcockpit.com/t/help-with-new-rules-addon-for-groups-collect-ideas-how-to-do/1995/5 "2021-07-08T08:18:29Z")

</div>

Oh misunderstanding on my side then.  
I thought you wanted to set the permissions for a group on collection level.

But yes, if you want to set the permissions on entry-item level then you might want to add a group-ownership info to each entry.

OR you add on-before-view/-edit/-delete a filter / limit access to items owned by current-users-group-member-ids.

---

<div class="post-metadata">

**Author:** ![abernh](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.getcockpit.com/abernh/32/859_2.png) [@abernh](https://discourse.getcockpit.com/u/abernh)\
**Post date:** [July 9, 2021, 7:03am UTC](https://discourse.getcockpit.com/t/help-with-new-rules-addon-for-groups-collect-ideas-how-to-do/1995/6 "2021-07-09T07:03:37Z")

</div>

I just found this perfect snippet in @raffaelj s snippet collection:

> <https://github.com/raffaelj/cockpit-scripts/blob/master/permissions/restrict-content-to-owner.php>

You’d now have to adjust this script to filter by owners-group-member-ids.

Or you add a similar snippet into the `collection->permissions->write` field which then saves the owner-group to-entry and then you can directly filter by owner-group.

---

<div class="post-metadata">

**Author:** ![Hackbard](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.getcockpit.com/hackbard/32/854_2.png) [@Hackbard](https://discourse.getcockpit.com/u/Hackbard)\
**Post date:** [July 12, 2021, 1:47pm UTC](https://discourse.getcockpit.com/t/help-with-new-rules-addon-for-groups-collect-ideas-how-to-do/1995/7 "2021-07-12T13:47:26Z")

</div>

Here is my first try in the develop branch.

> **[Hackbard/cockpit\_ExtendedGroups](https://github.com/Hackbard/cockpit_ExtendedGroups)**
>
> Extended Group Plugin for cockpit cms. Contribute to Hackbard/cockpit\_ExtendedGroups development by creating an account on GitHub.

I’ve seen the code snippet and i will rework 😛 that thing looks much better.