Is there a way to set permissions (privileges) through endpoints? about nodebb-plugin-write-api

[julianlam]

Unfortunately at this point in time, no, although it may be added in the future.

[jkirkpatrick]

That doesn't sound like it's un-possible, but I'm fairly new to nodebb. Is it low-priority or are there some major blockers? Should be in it's own sub-plugin instead of write api?

Category permissions is a requirement for me... I would be more than happy to submit a PR.

[metalcamp]

@julianlam I would like to help with this issue. Are you willing to provide some hints how to implement this feature?

[julianlam]

@mkranjec As privileges are assigned on a per-category basis, you'd want to create new PUT and DELETE routes in this file: https://github.com/NodeBB/nodebb-plugin-write-api/blob/master/routes/v1/categories.js

Perhaps you could pass in a query-string like so: ?privilege=groups:read&id=registered-users to allow registered users to read posts in cid 15. Likewise, DELETE to remove. Perhaps ?privilege[]= to add/remove multiple privileges.

You'll need checks to ensure the id passed in is a legitimate user or group. Privileges starting with group: only allow groups (obviously), so you can determine whether to call User.exists() or Groups.exists(); based on the privilege name.

For API completion, you'd probably want to also expose a GET route for each category (e.g. /api/v1/categories/:cid/privileges) that would list the privileges for each user/group with a Boolean value denoting whether they have it or not.

[leroydev]

Is there still interest in this?
For a hobby project, I've implemented this a while back here: https://github.com/leroydev/nodebb-plugin-write-api/commit/754974122c42f0df0b013be15e6fc5cbb94bdc1b.

I'm not sure if this code is good enough though.

[julianlam]

Yes, if you open a PR I can merge with some minor changes, like changing the route name to match existing nomenclature, and small stylistic suggestions. Thanks.

[leroydev]

@julianlam done :) Feel free to change / add stuff to the PR. :)