we already discussed the roles of contributors and users before, but i still think that the current implementations is not flexible enough, and that there will be soon scenarios where it won't be sufficient.

right now there is just a single property ("user may contribute"), but if you take a closer look you can identify the following actions which need to be granted or restricted to users:

• accessing a weblog (i.e. reading stories+comments)
• writing stories
• editing their own stories
• deleting their own stories
• editing other people's stories
• deleting other people's stories
• writing comments
• editing their own comments
• deleting their own comments
• editing other people's comments
• deleting other people's comments
• upload images
• remove images

the Admin of a Weblog should always have all those rights, and can also modify the weblog preferences and the skins.

so there are 3 user groups remaining:

• contributors
• registered users
• anonymous users

3 groups times 13 rights = 39 new properties for weblog !?!

looks complicated but should be really eeasy to implement, and is also the "cleanest" solution.

in order to make life easy for weblog-creators there should be a reasonable default setting for all those rights.

by the way: why shouldn't a user be able to sign up to a weblog? if the Admin doesn't want to be bothered by too many signup-emails, she should just skip the link/macro from the header skin. right?

the flag "users may contribute" is just for "opening" the weblog, that means that every registered user automatically becomes a contributor (like in this project-weblog). all other rights are defined in "membership"-objects for each single signed up user, where an admin can choose whether a user should become a contributor or even an admin.

i don't know if i got you right, but i strongly believe that no one (not even admins) should be able to edit the story of another admin/contributor. why? if i read a story from an author, i want to be sure that this story is from this author, and not that the he wrote this story and several others changed it - otherwise the display of the author-name is senseless. also, if i choose to allow contributions by another user, this is a sign of trust (otherwise i wouldn't do it), so there is not any need to change his/her stories. and finally, i strongly believe that owning a weblog or contributing to one has a lot to do with taking responsibility, so there should not be any need for "overruling".

the same with comments: i don't want anybody to be able to edit my comments, the only compromise i made was that admins are allowed to delete comments from other users (because this, as far as i experienced) is - sadly enough - sometimes necessary).

setting up 39 (!) properties (= db-columns) just for security means that admins have to enable/disable them (according to their needs), and this is imho far away from easy (besides that it's not what i would call "nice"). it also opens up a lot of possibilities for "senseless" configurations (i.e. contributors are not allowed to edit their own stories, but registered users are ...) or means that you have to do a lot of checking. and why should one be able to edit own stories, but not to delete them? i don't get the sense of this, but maybe i just got you wrong.

i can understand the necessity for improved rights management, although i would like to have a reality check with the 39 rights you proposed...

anyway, i imagine that such things that definitely cross the border between the weblog as such and a community communication commodore (giving eggs, wool, milk and pork) have to be opted-in. ie. there have to be switches that enable antville to behave like that. by default it certainly should be in "off" position.