Unexpected behaviour with shelf create permissions #2203

New Issue

OVERLORD · 2026-02-05T03:18:29+03:00

OVERLORD commented

2026-02-05 03:18:29 +03:00

Originally created by @maggie44 on GitHub (Apr 20, 2021).

With the custom permissions indicated in the attached image set on a shelf, I expected the behaviour to be:

Users can View + Users can Create new books + Users cannot update the shelf details + Users cannot delete the shelf

Instead, the Create permission does not appear to have any affect unless Update is also ticked. This in turn means I cannot let people contribute books to my shelf, without also allowing them to edit my Shelf details.

BookStack v21.04

Originally created by @maggie44 on GitHub (Apr 20, 2021). With the custom permissions indicated in the attached image set on a shelf, I expected the behaviour to be: Users can View + Users can Create new books + Users cannot update the shelf details + Users cannot delete the shelf Instead, the Create permission does not appear to have any affect unless Update is also ticked. This in turn means I cannot let people contribute books to my shelf, without also allowing them to edit my Shelf details. <img width="888" alt="Screenshot 2021-04-19 at 14 02 50" src="https://user-images.githubusercontent.com/64841595/115303924-1dbb4a80-a119-11eb-90ae-9bb7efc094dd.png"> BookStack v21.04

OVERLORD added the 🐛 Bug label 2026-02-05 03:18:29 +03:00

OVERLORD closed this issue

2026-02-05 03:18:33 +03:00

OVERLORD commented

2026-02-05 03:18:41 +03:00

@ssddanbrown commented on GitHub (Jun 2, 2021):

Thanks for raising @maggie0002.

Yeah, The create permissions are currently redundant, likely originally copied from the permission options of books.

This in turn means I cannot let people contribute books to my shelf, without also allowing them to edit my Shelf details.

Is this just an example of a flow that may be broken from the current permission behaviour? Or is this an ability that you actually desire for your usage? If you desired this permission to allow the adding/removing of books I think we'd want to rename "Create" to "Curate" or "Manage Assigned Content". That would also need some more complex changes in functionality since the behaviour is not set-up for separate editing and curation.

@ssddanbrown commented on GitHub (Jun 2, 2021): Thanks for raising @maggie0002. Yeah, The create permissions are currently redundant, likely originally copied from the permission options of books. > This in turn means I cannot let people contribute books to my shelf, without also allowing them to edit my Shelf details. Is this just an example of a flow that may be broken from the current permission behaviour? Or is this an ability that you actually desire for your usage? If you desired this permission to allow the adding/removing of books I think we'd want to rename "Create" to "Curate" or "Manage Assigned Content". That would also need some more complex changes in functionality since the behaviour is not set-up for separate editing and curation.

OVERLORD commented

2026-02-05 03:18:46 +03:00

@maggie44 commented on GitHub (Jun 2, 2021):

Thanks for raising @maggie0002.

Yeah, The create permissions are currently redundant, likely originally copied from the permission options of books.

This in turn means I cannot let people contribute books to my shelf, without also allowing them to edit my Shelf details.

Is this just an example of a flow that may be broken from the current permission behaviour? Or is this an ability that you actually desire for your usage? If you desired this permission to allow the adding/removing of books I think we'd want to rename "Create" to "Curate" or "Manage Assigned Content". That would also need some more complex changes in functionality since the behaviour is not set-up for separate editing and curation.

It is something I desired for my usage. Although it's not time sensitive. Perhaps best to flag this one for thought as part of the broader permissions review you note is scheduled in the readme?

@maggie44 commented on GitHub (Jun 2, 2021): > Thanks for raising @maggie0002. > > Yeah, The create permissions are currently redundant, likely originally copied from the permission options of books. > > > This in turn means I cannot let people contribute books to my shelf, without also allowing them to edit my Shelf details. > > Is this just an example of a flow that may be broken from the current permission behaviour? Or is this an ability that you actually desire for your usage? If you desired this permission to allow the adding/removing of books I think we'd want to rename "Create" to "Curate" or "Manage Assigned Content". That would also need some more complex changes in functionality since the behaviour is not set-up for separate editing and curation. It is something I desired for my usage. Although it's not time sensitive. Perhaps best to flag this one for thought as part of the broader permissions review you note is scheduled in the readme?

OVERLORD commented

2026-02-05 03:18:53 +03:00

@ssddanbrown commented on GitHub (Jun 20, 2023):

A note that #3073 and #4326 have had different expectations to this, in expecting to be able to create new books within this shelf (Which would raise other concerns due shelf->book relationship).

I think for now it'd be better to be pragmatic and go ahead to remove this option from view (and delete existing entries) so that it's not causing confusion. User abilities/actions that may have been desired from this can then be raised independently of this specific check-box/implementation.

@ssddanbrown commented on GitHub (Jun 20, 2023): A note that #3073 and #4326 have had different expectations to this, in expecting to be able to create new books within this shelf (Which would raise other concerns due shelf->book relationship). I think for now it'd be better to be pragmatic and go ahead to remove this option from view (and delete existing entries) so that it's not causing confusion. User abilities/actions that may have been desired from this can then be raised independently of this specific check-box/implementation.

OVERLORD commented

2026-02-05 03:18:57 +03:00

@ssddanbrown commented on GitHub (Jun 26, 2023):

Create permission now removed from view as per above, within 847a57a49a. Will be part of the next feature release.

@ssddanbrown commented on GitHub (Jun 26, 2023): Create permission now removed from view as per above, within 847a57a49aef525d2f7f429a30e58a34cf69d43f. Will be part of the next feature release.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/BookStack#2203