lockedit: Support specifying which users (and IP addresses) a page is locked for. This supports most of the ACL type things users have been wanting to be done. Closes: #443346 (It does not control who can read a page, but that's out of scope for ikiwiki.)

4 files changed, 26 insertions, 38 deletions

diff --git a/doc/ikiwiki/pagespec.mdwn b/doc/ikiwiki/pagespec.mdwn
index 156e3f6ca..c78666c40 100644
--- a/doc/ikiwiki/pagespec.mdwn
+++ b/doc/ikiwiki/pagespec.mdwn
@@ -22,8 +22,7 @@ match all pages except for Discussion pages and the SandBox:
 
 	* and !SandBox and !*/Discussion
 
-Some more elaborate limits can be added to what matches using any of these
-functions:
+Some more elaborate limits can be added to what matches using these functions:
 
 * "`link(page)`" - match only pages that link to a given page (or glob)
 * "`backlink(page)`" - match only pages that a given page links to
@@ -41,6 +40,13 @@ functions:
 * "`title(glob)`", "`author(glob)`", "`authorurl(glob)`",
   "`license(glob)`", "`copyright(glob)`" - match pages that have the given
   metadata, matching the specified glob.
+* "`user(username)`" - tests whether a modification is being made by a
+  user with the specified username. If openid is enabled, an openid can also
+  be put here.
+* "`admin()`" - tests whether a modification is being made by one of the
+  wiki admins.
+* "`ip(address)`" - tests whether a modification is being made from the
+  specified IP address.
 
 For example, to match all pages in a blog that link to the page about music
 and were written in 2005:
diff --git a/doc/ikiwiki/pagespec/attachment.mdwn b/doc/ikiwiki/pagespec/attachment.mdwn
index 1287fc0a4..2d33db748 100644
--- a/doc/ikiwiki/pagespec/attachment.mdwn
+++ b/doc/ikiwiki/pagespec/attachment.mdwn
@@ -16,45 +16,22 @@ check all attachments for virii, something like this could be used:
 The regular [[ikiwiki/PageSpec]] syntax is expanded with the following
 additional tests:
 
-* maxsize(size)
-
-  Tests whether the attachment is no larger than the specified size.
-  The size defaults to being in bytes, but "kb", "mb", "gb" etc can be
-  used to specify the units.
+* "`maxsize(size)`" - Tests whether the attachment is no larger than the
+  specified size. The size defaults to being in bytes, but "kb", "mb", "gb"
+  etc can be used to specify the units.
   
-* minsize(size)
-
-  Tests whether the attachment is no smaller than the specified size.
-
-* ispage()
+* "`minsize(size)`" - Tests whether the attachment is no smaller than the
+  specified size.
 
-  Tests whether the attachment will be treated by ikiwiki as a wiki page.
-  (Ie, if it has an extension of ".mdwn", or of any other enabled page
-  format).
+* "`ispage()`" - Tests whether the attachment will be treated by ikiwiki as a
+  wiki page. (Ie, if it has an extension of ".mdwn", or of any other enabled
+  page format).
 
   So, if you don't want to allow wiki pages to be uploaded as attachments,
   use `!ispage()` ; if you only want to allow wiki pages to be uploaded
   as attachments, use `ispage()`.
 
-* user(username)
-
-  Tests whether the attachment is being uploaded by a user with the
-  specified username. If openid is enabled, an openid can also be put here.
-
-* admin()
-
-  Tests whether the attachment is being uploded by one of the wiki admins.
-
-* ip(address)
-
-  Tests whether the attacment is being uploaded from the specified IP
-  address.
-
-* mimetype(foo/bar)
-
-  This checks the MIME type of the attachment. You can include a glob
-  in the type, for example `mimetype(image/*)`.
-
-* virusfree()
+* "`mimetype(foo/bar)`" - This checks the MIME type of the attachment. You can
+  include a glob in the type, for example `mimetype(image/*)`.
 
-  Checks the attachment with an antiviral program.
+* "`virusfree()`" - Checks the attachment with an antiviral program.
diff --git a/doc/plugins/lockedit.mdwn b/doc/plugins/lockedit.mdwn
index 07abce1af..71bf232ab 100644
--- a/doc/plugins/lockedit.mdwn
+++ b/doc/plugins/lockedit.mdwn
@@ -17,4 +17,8 @@ One handy thing to do if you're using ikiwiki for your blog is to lock
 posts in your blog, while still letting them comment via the Discussion
 pages.
 
-Wiki administrators can always edit locked pages.
+Wiki administrators can always edit locked pages. The [[ikiwiki/PageSpec]]
+can specify that some pages are not locked for some users. For example,
+"important_page and !user(joey)" locks `important_page` while still
+allowing joey to edit it, while "!*/Discussion and user(bob)" prevents bob
+from editing pages except for Discussion pages.
diff --git a/doc/todo/ACL.mdwn b/doc/todo/ACL.mdwn
index 373f89364..e9fb2717f 100644
--- a/doc/todo/ACL.mdwn
+++ b/doc/todo/ACL.mdwn
@@ -44,7 +44,8 @@ Also see [[!debbug 443346]].
 >> Yes, writing per-user commit ACLs has become somewhat easier with recent
 >> features. Breaking `match_user` out of attachment, and making the
 >> lockedit plugin pass`user` and `ip` params when it calls `pagespec_match`
->> would be sufficient. --[[Joey]]
+>> would be sufficient. And [[done]], configurable via
+>> [[plugin/lockedit]]'s `locked_pages`. --[[Joey]]
 
 I am considering giving this a try, implementing it as a module.
 Here is how I see it: