Private, group-internal events

Contribute Fout
1

Currently, event entries are always part of the calendar UI element which can be added to a category. There is no way to restrict an event to a special user group. If you have a multi-community Discourse setup, all communities see all the events of all the other communities. If you display the Discourse events externally on a website through an API call like

https://example.discourse.org/discourse-post-event/events.ics?user_api_key=[xxxxx]

it will display ALL events.

There should be an option to create “internal” events that are only displayed within a user group. These events should not be readable with the “general” ICS API request. Instead they should only be available either with a special, additional “group API key” or some other kind of save limitations. The use case is a selection between “public” events and events that are “private” and only visible and editable within a special user group.

:information_source: Correction: it looks as if created events within a group do already honour the group permissions on the calendar displayed inside the group-restricted categories. The only thing missing is some kind of restriction for the API calls through “https://example.discourse.org/discourse-post-event/events.ics?user_api_key=[xxxxx]”

1 like
2

Would creating a user that belongs only to the group you need, and generating the calendar subscription URL from that user’s preferences, work in your case? The feed would only include events that user can see.

1 like
3

Hmmm, I’m not shure. Sounds like a workaround, but not really like a “solution” :smiling_face_with_sunglasses:

All people within a Community-specific group should be able to create events. And also see them when they enter “their” communities category. This already works fine in our current setup with 5 different communities. We use the following category permissions:

  1. one category per community group. This one has “global read only” and “community read/create/reply”. This category is federated through AP to allow people without Discourse accounts to see events and also to allow integration of the Discourse calendar into 3rd party systems (e.g. WordPress with ICS plugin)
  2. a various number of internal sub-categories. These sub-categories only have “community read/create/reply” permissions. They are invisible without proper group permissions.

The only gaps are

  1. the current ics request presents ALL events
  2. some way to request only the events of a particular community through ICS/API.
4

All events, or all events the user whose API key is used has access to?

How do you imagine the process of selecting which events should be included in the particular request?

5

Good point.

There are two user levels for API keys: “single user” or “all users”. The API keys we currently use for the ICS request have “all user” level.

So, to solve this we probably would need API keys for “single user” level. And the selected user should only have the communities permission group, nothing else.

Let me check this. Maybe this could solve the issue …

1 like