Changes between Version 5 and Version 6 of S3/S3AAA/RecordApproval

Timestamp:

09/21/12 10:19:46 (12 years ago)

Author:

Dominic König

Comment:

--

S3/S3AAA/RecordApproval

@@ -87 +87 @@
 ...to reject (=delete) all unapproved records in a resource.
 
-S3CRUD shall implement the following methods:
+  '''Note:''' that S3Resource instances always exclude unapproved records, so these methods will always fail unless you define the resource with the unapproved=True parameter:
+{{{
+resource = current.s3db.resource("my_table", 1, unapproved=True)
+}}}
+
+  '''NOTE:''' resource.reject() is much more radical about record deletion than delete() - it will try to bypass any RESTRICTs and rigirously delete any dependency of the rejected records so they can not leave any undesired legacy behind. However, that means that reject() must always be properly authorized and strictly limited to unapproved records in tables which require approval.
+
+S3CRUD implements the '''review''' method to review/approve/reject records in a resource:
 
 {{{
@@ -96 +103 @@
 /controller/function/XY/review
 }}}
-...to review a particular record, which then gives the user the option to either:
+...to review/approve/reject a particular record.
 
-{{{
-POST /controller/function/XY/approve
-}}}
-...approve the record, or:
-{{{
-POST /controller/function/XY/reject
-}}}
-...reject it.
-
-  '''NOTE:''' resource.reject() is much more radical about record deletion than delete() - it will try to bypass any RESTRICTs and rigirously delete any dependency of the rejected records so they can not leave any undesired legacy behind. However, that means that reject() must always be properly authorized and strictly limited to unapproved records in tables which require approval.
-
-  '''Developer note:''' ''GET to {{{approve}}} or {{{reject}}} shall forward to {{{review}}} (for REST compliance)''
-
-  '''Developer note:''' ''If {{{approve}}} or {{{reject}}} are called without record ID, they shall raise a "Record Not Found" error rather than to approve/reject all unapproved records as per the requirement that a record can only be approved/rejects after it has been reviewed (=no bulk approval/reject).''
-
+   '''Note:''' For security reasons, both ''approve'' and ''reject'' via CRUD are only possible as POST requests which include the respective form keys from the ''review'' of a record.
 == Callbacks ==