Granular group-based permissions for anonymous and logged in users

[martin (Martin Brennan)]

@Noble_Fish , this is the AI-generated list of group based settings, what the setting is for, and how anonymous/logged in users apply to that setting. Be aware that I am reasonably confident this is correct, but like anything AI generated, it’s good to double-check the facts yourself.

I think the most interesting column is “everyone also included anonymous_users before change?”, if this is Yes that means everyone meant logged in AND anonymous before this upcoming change was applied.

As you can see, there are only a few in there, so those are the only ones that an admin would need to explicitly add anonymous_users to in site settings:

• hidden_post_visible_groups - I actually need to change this one to allow for anonymous_users, the code isn’t quite right for this upcoming change.
• lazy_load_categories_groups - I need to fix this one too, it does a redundant everyone check that’s already done inside user.in_any_groups?
• styleguide_allowed_groups - This works as is, but I will also tweak it a bit

When this upcoming change becomes permanent, the logged_in_users and anonymous_users groups will be used exclusively, and everyone will be deleted.

---

Setting	Description	logged_in_users applies?	anonymous_users applies?	everyone also included anonymous_users before change?	Code finding
whispers_allowed_groups	Allow private communication within topics for members of specified groups.	No	No	No	everyone, logged_in_users, and anonymous_users are disallowed; runtime also expects concrete/group membership.
hidden_post_visible_groups	Allow members of these groups to view hidden posts. Staff users can always view hidden posts.	Yes	No	Yes	Checks everyone before rejecting anonymous users; otherwise uses in_any_groups?.
about_page_hidden_groups	Do not show members of specific groups on the /about page.	No	No	No	Uses group_users; pseudogroups have no member rows.
about_page_extra_groups	Groups to show on the about page below the moderators.	No	No	No	Loads concrete groups and members for display.
anonymous_posting_allowed_groups	Groups that are allowed to enable anonymous posting.	Yes	No	No	Logged-in user gate via in_any_groups?; anonymous_users is disallowed.
personal_message_enabled_groups	Allow users in these groups to create personal messages.	Yes	No	No	Logged-in user gate via in_any_groups?; anonymous_users is disallowed.
shared_drafts_allowed_groups	Allow users in these groups to see and edit Shared Drafts.	Yes	No	No	Logged-in guardian gate; anonymous_users is disallowed.
here_mention_allowed_groups	Groups that are allowed to mention @here.	Yes	No	No	Requires authenticated user; anonymous_users is disallowed.
approve_unless_allowed_groups	Posts by users not in these groups must be approved.	Yes	No	No	User gate via in_any_groups?; anonymous_users is disallowed.
approve_new_topics_unless_allowed_groups	New topics by users not in these groups must be approved.	Yes	No	No	User gate via in_any_groups?; anonymous_users is disallowed.
skip_review_media_groups	Users outside these groups have posts with embedded media sent for review.	Yes	No	No	User gate via in_any_groups?; anonymous_users is disallowed.
content_localization_allowed_groups	Groups allowed to update localized content.	Yes	No	No	Guardian/user gate; anonymous_users is disallowed.
email_in_allowed_groups	Groups that are allowed to post new topics via email.	Yes	No	No	Email sender user gate; anonymous_users is disallowed.
view_raw_email_allowed_groups	Groups which can view raw incoming email content.	Yes	No	No	Guardian user gate; anonymous_users is disallowed.
uploaded_avatars_allowed_groups	Specify groups allowed to upload custom profile pictures.	Yes	No	No	Current/target user gate; anonymous_users is disallowed.
create_topic_allowed_groups	Groups that are allowed to create new topics.	Yes	No	No	Requires user and uses in_any_groups?; anonymous_users is disallowed.
topic_timers_allowed_groups	Groups that are allowed to set topic timers.	Yes	No	No	Guardian user gate; anonymous_users is disallowed.
edit_wiki_post_allowed_groups	Groups that are allowed to edit posts marked as wiki.	Yes	No	No	Guardian user gate; anonymous_users is disallowed.
edit_post_allowed_groups	Groups that are allowed to edit posts.	Yes	No	No	Guardian user gate; anonymous_users is disallowed.
self_wiki_allowed_groups	Allow users in these groups to make their own posts wiki.	Yes	No	No	Guardian user gate; anonymous_users is disallowed.
send_email_messages_allowed_groups	Groups that are allowed to send personal messages via email.	Yes	No	No	Guardian user gate; anonymous_users is disallowed.
flag_post_allowed_groups	Groups that are allowed to flag posts.	Yes	No	No	Guardian user gate; anonymous_users is disallowed.
post_links_allowed_groups	Groups that are allowed to include links in posts.	Yes	No	No	Requires authenticated user; anonymous_users is disallowed.
embedded_media_post_allowed_groups	Users in these groups are allowed to embed media items in a post.	Yes	No	No	Acting user gate; anonymous_users is disallowed.
profile_background_allowed_groups	Groups that are allowed to upload a profile background.	Yes	No	No	User gate; anonymous_users is disallowed.
user_card_background_allowed_groups	Groups that are allowed to upload a user card background.	Yes	No	No	User gate; anonymous_users is disallowed.
invite_allowed_groups	Groups that are allowed to invite users.	Yes	No	No	Guardian user gate; anonymous_users is disallowed.
ignore_allowed_groups	Groups that are allowed to ignore other users.	Yes	No	No	Guardian user gate; anonymous_users is disallowed.
delete_all_posts_and_topics_allowed_groups	Groups allowed to delete posts and topics created by other users and see deleted content.	Yes	No	No	Guardian/current user gate; anonymous_users is disallowed.
edit_all_topic_groups	Allow users in this group to edit other users’ topic titles, tags, and categories.	Yes	No	No	Raw split then in_any_groups?; anonymous_users is disallowed.
edit_all_post_groups	Allow users in this group to edit other users’ posts.	Yes	No	No	User gate via in_any_groups?; anonymous_users is disallowed.
change_post_ownership_allowed_groups	Allow users in these groups to change post ownership.	Yes	No	No	Current user gate; anonymous_users is disallowed.
cross_origin_opener_unsafe_none_groups	Hidden COOP override groups; matched users get Cross-Origin-Opener-Policy: unsafe-none.	Yes	No	No	Requires current_user.present?; anonymous selection has no runtime effect.
user_api_key_allowed_groups	Group membership required for generation of user API keys.	Yes	No	No	Current user gate; anonymous_users is disallowed.
create_tag_allowed_groups	Groups that are allowed to create tags.	Yes	No	No	Guardian user gate; anonymous_users is disallowed.
edit_tags_allowed_groups	Groups that are allowed to edit tags, tag descriptions, and tag synonyms.	Yes	No	No	Guardian user gate; anonymous_users is disallowed.
tag_topic_allowed_groups	Groups that are allowed to tag topics.	Yes	No	No	Guardian user gate; anonymous_users is disallowed.
pm_tags_allowed_for_groups	Allow members of included groups to tag any personal message.	Yes	No	No	Guardian user gate; anonymous_users is disallowed.
lazy_load_categories_groups	Lazy load category information only for users of these groups.	Yes	Yes	Yes	Explicit everyone check plus guardian in_any_groups?; anonymous_users is meaningful.
chat_allowed_groups	Users in these groups can chat, except anonymous users who can only view chat when added to this setting.	Yes	Yes	No	Logged-in chat uses in_any_groups?; anonymous public chat explicitly checks anonymous_users.
direct_message_enabled_groups	Allow users within these groups to create user-to-user Personal Chats.	Yes	No	No	Logged-in chat guardian gate; no meaningful anonymous DM path.
chat_pinning_messages_allowed_groups	Users in these groups are allowed to pin chat messages.	Yes	No	No	Requires chat access/current user; no anonymous pin path.
chat_message_flag_allowed_groups	Users in these groups are allowed to flag chat messages.	Yes	No	No	User gate; anonymous path is blocked by surrounding chat permissions.
no_ads_for_groups	Don’t show ads to users in these groups.	Yes	No	No	Added to current_user serializer only; no anonymous current-user payload.
adsense_exclude_groups	Ads will not be shown to members of these groups.	Yes	No	No	Current-user ad flag via in_any_groups?; no anonymous current-user payload.
dfp_exclude_groups	Ads will not be shown to members of these groups.	Yes	No	No	Current-user ad flag via in_any_groups?.
amazon_exclude_groups	Ads will not be shown to members of these groups.	Yes	No	No	Current-user ad flag via in_any_groups?.
carbonads_exclude_groups	Ads will not be shown to members of these groups.	Yes	No	No	Current-user ad flag via in_any_groups?.
adbutler_exclude_groups	Ads will not be shown to members of these groups.	Yes	No	No	Current-user ad flag via in_any_groups?.
composer_ai_helper_allowed_groups	Users in these groups will see the AI helper button in the composer.	Yes	No	No	Logged-in AI helper gate via in_any_groups?.
post_ai_helper_allowed_groups	User groups allowed to access AI Helper features in posts.	Yes	No	No	Logged-in AI helper gate via in_any_groups?.
ai_pm_summarization_allowed_groups	Groups allowed to create and view summaries in PMs.	No	No	No	Uses raw user.group_ids, so pseudogroups do not match.
ai_bot_debugging_allowed_groups	Allow these groups to see a debug button showing the raw AI request and response.	Yes	No	No	Explicitly returns false for anonymous, then uses in_any_groups?.
ai_bot_allowed_groups	When the GPT Bot has access to the PM, it will reply to members of these groups.	Yes	No	No	Primary gates use in_any_groups?; one playground path uses raw group_ids.
ai_bot_public_sharing_allowed_groups	Allow these groups to share AI personal messages with the public via a unique link.	Yes	No	No	Explicitly returns false for anonymous, then uses in_any_groups?.
assign_allowed_on_groups	Users in these groups are allowed to assign topics.	No	No	No	Uses raw user.group_ids/GroupUser; pseudogroups have no rows.
discourse_post_event_allowed_on_groups	Groups that are allowed to create events.	No	No	No	Raw groups.where(id: ...); everyone is special-cased, but logged_in_users is not.
discourse_kanban_manage_board_allowed_groups	Groups allowed to create and configure kanban boards.	Yes	No	No	Guardian uses in_any_groups?, but write controllers require login.
create_policy_allowed_groups	Group membership required for adding policies to posts.	Yes	No	No	Post/user gate via in_any_groups?.
flag_posts_voting_comments_allowed_groups	Groups allowed to flag a post voting comment.	Yes	No	No	User gate via in_any_groups?.
allow_solved_in_groups	Allow marking solutions in group messages for these groups.	No user gate	No user gate	No user gate	Matches PM topic.allowed_groups, not current user membership.
accept_all_solutions_allowed_groups	Groups that are allowed to accept solutions on any topic.	Yes	No	No	Authenticated/current user gate via in_any_groups?.
discourse_templates_groups_allowed_private_templates	Groups allowed to use private templates.	No	No	No	Raw GroupUser.exists?; only everyone is special-cased.
poll_create_allowed_groups	The groups that are allowed to create polls.	Yes	No	No	Acting/current user gate via in_any_groups?.
styleguide_allowed_groups	Limits visibility of the styleguide to members of the provided groups.	Yes	Yes	Yes	Controller explicitly handles anonymous_users; it also allowed anonymous through everyone before the change.