From redaxo-ycom
Configures YCom article/media permissions via auth/group/media_auth plugins, including .htaccess protection, login/group redirects, and PHP API for access checks/queries.
npx claudepluginhub friendsofredaxo/claude-marketplace --plugin redaxo-ycomThis skill uses the workspace's default tool permissions.
Permissions in YCom come in two layers: per-article (via the `auth` plugin) and per-media-file (via the `media_auth` plugin). Both can be tightened by group membership when the `group` plugin is active.
Suggests manual /compact at logical task boundaries in long Claude Code sessions and multi-phase tasks to avoid arbitrary auto-compaction losses.
Share bugs, ideas, or general feedback.
Permissions in YCom come in two layers: per-article (via the auth plugin) and per-media-file (via the media_auth plugin). Both can be tightened by group membership when the group plugin is active.
auth)Each article has a permission type set in the structure backend:
| Value | Meaning |
|---|---|
| 0 | Inherit from parent (default: accessible to all) |
| 1 | Only logged-in users (+ optional group checks) |
| 2 | Only NOT logged-in users (e.g. registration page) |
| 3 | Accessible to all (overrides parent) |
YCom intercepts the request in rex_ycom_auth::init():
article_id_loginarticle_id_jump_deniedTo check programmatically:
$article = rex_article::get($id);
rex_ycom_auth::articleIsPermitted($article); // bool
Hide gated articles from navigation:
$nav = rex_navigation::factory();
$nav->addCallback('rex_ycom_auth::articleIsPermitted');
echo $nav->show(0, 1, true, true);
Groups add finer-grained permissions on top of "logged in or not".
| Value | Meaning |
|---|---|
| 0 | Accessible for all groups |
| 1 | User must be in ALL specified groups |
| 2 | User must be in at least ONE specified group |
| 3 | User must have NO groups |
// Get all groups
$groups = rex_ycom_group::getGroups(); // [id => name]
// Check user group membership
$user->isInGroup($group_id);
// Get users in a group
$users = rex_ycom_group::get($id)->getRelatedCollection('ycom_groups');
// Get user's groups as YOrm collection
foreach ($user->getRelatedCollection('ycom_groups') as $group) {
echo $group->getValue('name');
}
$user = rex_ycom_auth::getUser();
if ($user) {
// getRelatedDataset returns the FIRST related group only — fine when each
// user has exactly one group. For multi-group users, iterate the collection
// and pick the highest-priority target instead.
$group = $user->getRelatedDataset('ycom_groups');
if ($group) {
$target = (int) $group->getValue('target_id'); // custom be_link field on the group table
if ($target) {
rex_response::sendRedirect(rex_getUrl($target));
}
}
}
Add a target_id field (type be_link) to the YCom group table so editors can configure where each group lands after login. Multi-group example:
foreach ($user->getRelatedCollection('ycom_groups') as $group) {
$target = (int) $group->getValue('target_id');
if ($target) {
rex_response::sendRedirect(rex_getUrl($target));
return;
}
}
rex_extension::register('YCOM_ARTICLE_PERM_SELECT', function (rex_extension_point $ep) {
// Customize the permission select dropdown shown in the structure sidebar
});
Protects files in the REDAXO media pool from direct download.
media_auth depends on it).media_auth plugin..htaccess:RewriteRule ^media/(.*) %{ENV:BASE}/index.php?rex_media_type=default&rex_media_file=$1&%{QUERY_STRING} [B]
This routes every /media/... request through index.php, where YCom can decide whether to serve the file.
Each media file gets a permission type set in the media pool:
| Value | Meaning |
|---|---|
| 0 | Accessible to all |
| 1 | Only logged-in users |
For group-scoped media access, combine with the group plugin.
| Rule | Behavior |
|---|---|
redirect | Redirect to login page |
redirect_with_errorpage | Redirect to login if not logged in, error page if already logged in |
header_notfound | Return 404 |
header_perm_denied | Return 401 |
header_notfound is the most discreet — leaks no information about the file's existence.
$media = rex_media::get('filename.pdf');
rex_ycom_media_auth::checkFrontendPerm($media); // bool
Use this when you build a custom download endpoint and need to verify access manually.
2 (only NOT logged in) — otherwise logged-in users get bounced to the post-login redirect when they navigate to it..htaccess rewrite for media_auth — the plugin is active but files are still served directly by Apache, bypassing checks.header_notfound for files that should be discoverable to logged-in users — the 404 doesn't differentiate; users get told the file doesn't exist instead of "log in to access".rex_ycom_media_auth::checkFrontendPerm() from a backend context — it checks the frontend session, returns false in backend context. Use a backend-specific check instead.