Blog permissions
v0.0.1
The blog splits its admin access into two areas, editorial and comments, and asks for each on two surfaces, the dashboard and the admin API. Setting the blog up creates the six names below. This page lists them, what each opens, and which fields are limited to an area. For how names and wildcards work in general, see How permissions work.
Permission names
| Name | Surface | Description |
|---|---|---|
admin:dashboard:blog:* | Dashboard | The whole blog on the dashboard: posts and comments. |
admin:dashboard:blog:post | Dashboard | The editorial side of the blog: posts, collections, tags, bloggers, teams and auto posting, with their views, ratings, bookmarks and follows. Holders are told when a post is published. |
admin:dashboard:blog:comment | Dashboard | Comment moderation: comments and comment votes. |
admin:api:blog:* | Admin JSON:API | The whole blog over the admin JSON:API. |
admin:api:blog:post | Admin JSON:API | Posts, collections, tags, bloggers, teams and auto posting over the admin JSON:API. |
admin:api:blog:comment | Admin JSON:API | Comments over the admin JSON:API. |
A name counts only on its own surface. A dashboard name never opens an API route, and an API name never opens a screen.
Names that also cover the blog
| Wildcard | Covers |
|---|---|
admin:dashboard:blog:* | Both dashboard areas of the blog. |
admin:dashboard:* | Every dashboard area, including both of the blog. |
admin:api:blog:*, admin:api:* | Both API areas of the blog. |
admin:* | Both surfaces. |
* | Everything, on the account's own site. |
What each area opens
| Screen or record | Dashboard name | API name |
|---|---|---|
| Blog menu entry and the Blog dashboard | admin:dashboard:blog:post or admin:dashboard:blog:comment | Not applicable. |
| Posts, Collections, Tags, Bloggers, Teams, Auto Posting, Analytics | admin:dashboard:blog:post | admin:api:blog:post |
| Comments and comment votes | admin:dashboard:blog:comment | admin:api:blog:comment |
| Post views, ratings and bookmarks, and team follows, when read for administration | admin:dashboard:blog:post | admin:api:blog:post |
A holder of the comment area alone cannot open the post screens, and a holder of the post area alone cannot open the Comments screen. On the Blog dashboard, a card, figure or link whose area the account does not hold is not drawn.
Fields limited to an area
| Field | Record | Needs |
|---|---|---|
comment_count | Post | Post area |
version_count, latest_version, recent_versions | Post, collection, tag, blogger, team, auto posting | Post area |
can_publish_directly, author_email | Blogger | Post area |
sender_data | Comment | Comment area |
The count approved_comment_count is public. comment_count counts every status, so it is limited to the post area.
Names for setting the blog up
Setting the blog up, repairing it and updating its components needs all four of these names, or a wildcard that covers them.
admin:dashboard:runtime:componentadmin:dashboard:runtime:stylesheetadmin:dashboard:runtime:pageadmin:dashboard:runtime:site
Sites
- A master, which is an account with no site, reads and writes the blog rows of every site.
- An account that belongs to a site reads and writes the rows of its own site only, whatever name it holds.
Other names that matter
- Any name in the permission catalogue can go in the Permissions field of a post, collection or tag, except one that starts with
admin:api:, which opens for nobody. Holding one of the others opens that record. See How blog locks work. - Changing the permissions attached to a team needs
admin:dashboard:permissionoradmin:api:permissionbesides the post area. Team members do not inherit them. - Readers do not need an admin name to comment, rate, bookmark, vote or follow. They need to be signed in.