Add permissions to maintain registrations for editable host entities

Thanks for the post. You are right that "Administer own registrations" gives you the Manage Registrations tab on editable host entities, with Registrations, Settings and Email Registrants as options, and that the Registrations option only gives you a summary. ("Administer own settings" and "Update own registrations" are implied by "Administer own registrations".) "View own registrations" gives you a Registrations tab when viewing your account, and the "Administer own" permission then gives you view/edit/delete to the items in that tab.

Adding "View any registrations" permission turns the Manage Registrations summary into a listing. Adding "Edit any registrations" permission gives you edit access to the items in that listing. It is true though that giving "View any" and "Edit any" extends to any registration, not just registrations for the host entity the user has edit access to.

I think what you are asking for is super-user access (view/edit/delete) to all the registrations for any host the user has edit access to. And no access to any other registrations. Basically to cordon off access to only registrations for host entities you authored or can edit. Can you confirm? I can see how the "Manage registrations for editable entities" permission might seem to imply this super-user access - but in reality it only gives you the Manage registrations tab, and then you have to add more permissions on top of it to get more than a summary.

Hey thanks for your responsiveness to this post and my previous one. Appreciate the change in 3.1.4.

Yes, that's correct. I wanted a user to be able to view/edit/delete registrations on the host entities / content they create but not be able to view/edit/delete registrations on content they did not create. Cordoning off access to only registrations for host entities you authored or can edit, like you said.

However, I think after reading your second paragraph and testing, I have a good enough solution. I was worried "View any registration" would provide too much access, but it seems like "Manage registrations for editable entities - Manage registrations of this type for host entities to which a user has edit access." paired with "View any registration" provides me enough functionality and the correct functionality.

In my testing, "View any registration" seemingly does nothing without "Manage registrations for editable entities" because only the host entity editor gets the 'Manage Registrations' button. Together these allow only the editor of the host entity to view any registration. So pairing these two together works for me. The host entity editor can view a listing of the registrations instead of just a summary with these two permissions. The non-host cannot view anything because they do not get the 'Manage Registrations' button. I attached two screenshots showing the different views. Is this expected behavior?

I'm fine with my users only having View capability and do not require Edit/Delete, so I can close this out unless you want to pursue this.

Yes that is expected and is working correctly. Let's leave this issue open though - the solution you crafted using the existing permissions is correct, but it has one drawback - someone can guess at the URL of a registration not on their manage registrations listing (replace the registration number with a different one) and in this way gain access to view a registration that you might not want them to be able to see. Could be ok for your site, but I might as well close this loophole. I'll get a new permission added soon for this case.

Ah yes makes sense. Good call. Thanks!

Committed to dev branch and will be in the next release. Also added this draft change record → . The record will be published at the time of the next release.

Automatically closed - issue fixed for 2 weeks with no activity.