Publishing policies reference

Exact names, values and behavior of container publishing policies. For a guided setup, follow Publishing policies. Examples use the Forum plugin's forum.forums collection.

policies optionCopy Anchor Link

defineContentContainer({ policies }) from @vitnode/core/content:

policies: {
  defaults: { publish: "immediate", edits: "immediate", authorEdit: "always" },
  contentTypes: {
    "forum.comment": { authorEdit: "window", authorEditMinutes: 30 },
  },
},

Omit policies, or set it to false, and the collection does not take part: its content types use publicWrite.create.status, owners edit for as long as update.own allows, can_edit stays unscoped and no can_approve exists. policies: {} turns the feature on with every key on its fallback.

Policy keysCopy Anchor Link

A policy is a partial object of these keys. Each one is resolved on its own.

The constants are exported from @vitnode/core/content: CONTENT_CONTAINER_POLICY_KEYS, CONTENT_CONTAINER_POLICY_CREATE, CONTENT_CONTAINER_POLICY_MODES, CONTENT_CONTAINER_POLICY_AUTHOR_EDIT and CONTENT_CONTAINER_POLICY_MAX_MINUTES.

Resolution orderCopy Anchor Link

For each key, the first layer that sets it wins:

1. the record's container's override for the content type;
2. the nearest ancestor's override, walking parentId;
3. policies.contentTypes[contentTypeId];
4. policies.defaults;
5. the fallback in the table above.

A missing key inherits. An explicit value, including "never" or a value equal to the parent's, is an override and stops the walk. The engine never stores undefined, and empty per-type objects are dropped on save.

The record's container is always resolved on the server: from its field.container(), or for a field.relation({ container: true }), from the related record's container. A comment follows its topic, whatever the payload claims.

Who passes which ruleCopy Anchor Link

Container scopes are explained in Container-scoped permissions.

Refusals on the public write routesCopy Anchor Link

Both answer 403 with "code": "CONTENT_FORBIDDEN" and one issue whose field is null:

{
  "code": "CONTENT_FORBIDDEN",
  "contentTypeId": "forum.comment",
  "issues": [
    { "code": "edit_window_closed", "field": null, "message": "Public write denied: forbidden." }
  ]
}

An owner editing a record the public cannot read, such as a hidden one, still gets 404 with no issue, so the answer never confirms it exists. A submission opened by publish or edits is described in Approvals.

AdminCP routesCopy Anchor Link

Mounted only for a collection with policies, in the admin module, under /api/{pluginId}/admin/content/{admin.permissionModule}. For the forum that is /api/@vitnode/forum/admin/content/forum_forums.

PUT replaces the container's whole overrides object. overrides maps a content type id to a policy, and only content types filed in the collection with publicWrite are accepted. A saved change expires the collection's page cache and emits content.container.updated with changedFields: ["policies"]. Saving the same overrides again changes nothing and emits nothing.

{ "overrides": { "forum.topic": { "publish": "approve" } } }

Policy reportCopy Anchor Link

A source is { kind: "container", containerId }, { kind: "contentType" }, { kind: "default" } or { kind: "fallback" }.

ErrorsCopy Anchor Link

Errors answer { code, message }:

Definition errorsCopy Anchor Link

defineContentContainer throws a ContentEngineError when the module loads:

Server helpersCopy Anchor Link

From @vitnode/core/content (browser-safe):

From @vitnode/core/content/server:

The container service from createContentContainerService has policies(id) and updatePolicies(id, overrides), the same calls the routes make.