# 为匿名和登录用户设置基于组的细粒度权限

**URL:** https://meta.discourse.org/t/granular-group-based-permissions-for-anonymous-and-logged-in-users/402273
**Category:** Announcements
**Tags:** groups
**Created:** [2026年五月13日 01:18 UTC](https://meta.discourse.org/t/granular-group-based-permissions-for-anonymous-and-logged-in-users/402273 "2026-05-13T01:18:57Z")
**Posts on this page:** 1
**Showing post:** 19

<div class="post-metadata">

### Author: ![martin](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/martin/32/491371_2.png) [@martin](https://meta.discourse.org/u/martin)
#### Post date: [2026年七月16日 03:48 UTC](https://meta.discourse.org/t/granular-group-based-permissions-for-anonymous-and-logged-in-users/402273/19 "2026-07-16T03:48:29Z")

</div>

> [@martin](#):
>
> 以群组侧边栏菜单为例，我认为应该以相同的方式实现，因此配置中会有如下内容：
> 
> ```plaintext
> groups:
> type: groups
> required: true
> resolve_group_memberships: true
> validations:
> max: 20
> 
> ```
> 
> 然后在客户端，`groups` 将变为布尔值 `user_in_groups`。

我已在下面的 PR 中实现了此功能：

> <https://github.com/discourse/discourse/pull/41756>
>
> Followup 7e77ce4bd3889820d67b52a5788357ac6f7b2f58
> 
> We need to automatically re…solve group membership into a boolean
> for theme object type settings which are of the group type, similar
> to what we did in the original commit above for group list type
> settings.
> 
> This behaves in the same way -- for an object setting schema like this:
> 
> \`\`\`
> menu\_sections:
> type: objects
> default:
> - name: section 1
> groups:
> - 1
> - 3
> schema:
> name: menu section
> properties:
> name:
> type: string
> groups:
> type: groups
> resolve\_group\_membership: true
> \`\`\`
> 
> We replace \`groups\` with a boolean \`user\_in\_groups\` (groups is just
> the property name, it could be foo\_bar etc.) and then you can
> do this on the client:
> 
> \`\`\`
> for (const section of settings.menu\_sections) {
> if (section.user\_in\_groups) {
> // User is in at least one selected group for this section.
> }
> }
> \`\`\`
> 
> Rather than inspecting the \`currentUser.groups\`, which only includes
> visible groups, not all groups the user is a member of. This allows
> for more accurate permission checks for theme settings that are group
> based.
> 
> Also c.f. https://meta.discourse.org/t/granular-group-based-permissions-for-anonymous-and-logged-in-users/402273/18?u=martin

另外 @Lilly，我从一个分支向你的 group-sidebar-menus 主题组件提交了一个 PR，以向后兼容的方式应用了此功能：

> <https://github.com/Lillinator/group-sidebar-menus/pull/5>
>
> See https://github.com/discourse/discourse/pull/41756, which must
> be merged fir…st
> 
> \`resolve\_group\_membership\` can now be used on group type of theme setting object settings, so instead of relying on currentUser.groups which only has visible groups in the client, we can use \`user\_in\_groups\` which is automatically resolved from the server side
> 
> This is backwards-compatible with sites that don't yet have the
> core functionality deployed

接下来将处理 `disallowed_groups` 部分。

---

_[View the full topic](https://meta.discourse.org/t/granular-group-based-permissions-for-anonymous-and-logged-in-users/402273)._