bq.{quote} Fact is that we have [RightsFilterListener|https://github.com/xwiki/xwiki-platform/blob/2557813aef3b863988d6cca58de996e207086898/xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-authorization/xwiki-platform-security-authorization-bridge/src/main/java/org/xwiki/security/authorization/internal/RightsFilterListener.java#L63] nowadays to handle the rights part that is mentioned in the issue. bq. If rights should be modifiable by users is an open debate afaik.
We basically have that use case already with many things like UI extensions with certain scopes for example. In many cases, the rights situation is more complex and the rights you need to have depend on the chosen parameter values. Our solution currently consists of:
* ignoring the object unless the last author has the necessary rights * having required rights analyzers for the objects of an XClass that trigger warnings on editing when the right is added or lost, and that lead to a recommended enforced required right that would prevent losing the right.
It could be interesting to have something simple on the XClass level, like to say to add or modify such an object you need to have a certain right which would translate into an automatic required rights analyzer but I'm not sure how frequently we have that case.
We could extend this, like saying we deny saving unless the user has the required right (by analyzing the document before saving). So for example to disallow saving a page when you add a UI extension with wiki scope without having wiki admin right. {quote}
This message was sent by Atlassian Jira (v9.3.0#930000-sha1:287aeb6)
If image attachments aren't displayed, see this article.
