"Save & Publish" available when a "Document Type" approval workflow is in place

[evans-t]

We have created a Document Type approval flow:

However "Save & Publish" remains an option when editing the node:

This essentially means it's possible to bypass the Workflow.

I would expect that with the "Flow type" set to "Exclude" it should not be possible to "Save & Publish", as the Workflow should not allow the user to "Approve" their own changes.

Umbraco Workflow Version 15.1.5

---

This item has been added to our backlog AB#54340

[nathanwoulfe]

Heya @evans-t just checking - does the user happen to have access to the Workflow section? Any users with such permission are considered workflow administrators, and will always see their default permissions. If so, this is working as expected, if not, I have a bug to investigate...

[evans-t]

Hi @nathanwoulfe - yes the users do have access to the Workflow section. I guess this becomes a feature request then, for more granular permissions.

The situation I have is that I need the client to be able to manage the review group and access the history - but they shouldn't be able to bypass the publishing Workflow for content.

[nathanwoulfe]

There is a setting to extend permissions, which might solve the problem - if that is false, it should only show the workflow buttons (thus removing the CMS actions). However, I think access to the workflow section will override that setting.

It makes sense to be a setting/permission, as it's visible and deterministic rather than being managed magically by Workflow.

I'll make it happen in the next 15/16 patches.

[nathanwoulfe]

@evans-t this will be part of a larger change around settings and permissions - so not included in the next patches. Plan is to move Workflow settings into the Settings section, so that we can be more granular around who can do what, based on settings access and workflow-section access.

[nathanwoulfe]

@evans-t checking in so you don't think I've forgotten about this 😄

Current plan is to release an overhaul of Workflow's permissions and settings in v17 (possibly in a v16 minor prior to 17, but given the nature of the changes, feels more like it belongs in a major). Regardless of when it lands, the changes will introduce granular permissions for Workflow features, and consolidate the global settings into the Settings section to allow separating access to the Workflow section from the implied Workflow administrator role.

[nathanwoulfe]

And another update @evans-t - this will be in the 17-rc release later this week, would be great to get some feedback on whether the approach I've taken gives enough flexibility