Unexpected behaviour with shelf create permissions

[maggie44]

With the custom permissions indicated in the attached image set on a shelf, I expected the behaviour to be:

Users can View + Users can Create new books + Users cannot update the shelf details + Users cannot delete the shelf

Instead, the Create permission does not appear to have any affect unless Update is also ticked. This in turn means I cannot let people contribute books to my shelf, without also allowing them to edit my Shelf details.

BookStack v21.04

[ssddanbrown]

Thanks for raising @Maggie0002.

Yeah, The create permissions are currently redundant, likely originally copied from the permission options of books.

This in turn means I cannot let people contribute books to my shelf, without also allowing them to edit my Shelf details.

Is this just an example of a flow that may be broken from the current permission behaviour? Or is this an ability that you actually desire for your usage? If you desired this permission to allow the adding/removing of books I think we'd want to rename "Create" to "Curate" or "Manage Assigned Content". That would also need some more complex changes in functionality since the behaviour is not set-up for separate editing and curation.

[maggie44]

Thanks for raising @Maggie0002.

Yeah, The create permissions are currently redundant, likely originally copied from the permission options of books.

This in turn means I cannot let people contribute books to my shelf, without also allowing them to edit my Shelf details.

Is this just an example of a flow that may be broken from the current permission behaviour? Or is this an ability that you actually desire for your usage? If you desired this permission to allow the adding/removing of books I think we'd want to rename "Create" to "Curate" or "Manage Assigned Content". That would also need some more complex changes in functionality since the behaviour is not set-up for separate editing and curation.

It is something I desired for my usage. Although it's not time sensitive. Perhaps best to flag this one for thought as part of the broader permissions review you note is scheduled in the readme?

[ssddanbrown]

A note that #3073 and #4326 have had different expectations to this, in expecting to be able to create new books within this shelf (Which would raise other concerns due shelf->book relationship).

I think for now it'd be better to be pragmatic and go ahead to remove this option from view (and delete existing entries) so that it's not causing confusion. User abilities/actions that may have been desired from this can then be raised independently of this specific check-box/implementation.

[ssddanbrown]

Create permission now removed from view as per above, within 847a57a. Will be part of the next feature release.