Index: openacs-4/packages/acs-subsite/www/permissions/grant-2-oracle.xql
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/acs-subsite/www/permissions/Attic/grant-2-oracle.xql,v
diff -u -N
--- openacs-4/packages/acs-subsite/www/permissions/grant-2-oracle.xql	30 Apr 2001 22:02:48 -0000	1.1
+++ /dev/null	1 Jan 1970 00:00:00 -0000
@@ -1,17 +0,0 @@
-<?xml version="1.0"?>
-
-<queryset>
-   <rdbms><type>oracle</type><version>8.1.6</version></rdbms>
-
-<fullquery name="grant">      
-      <querytext>
-      
-  begin
-    acs_permission.grant_permission(:object_id, :party_id, :privilege);
-  end;
-
-      </querytext>
-</fullquery>
-
- 
-</queryset>
Index: openacs-4/packages/acs-subsite/www/permissions/grant-2-postgresql.xql
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/acs-subsite/www/permissions/Attic/grant-2-postgresql.xql,v
diff -u -N
--- openacs-4/packages/acs-subsite/www/permissions/grant-2-postgresql.xql	30 Apr 2001 22:02:48 -0000	1.2
+++ /dev/null	1 Jan 1970 00:00:00 -0000
@@ -1,15 +0,0 @@
-<?xml version="1.0"?>
-
-<queryset>
-   <rdbms><type>postgresql</type><version>7.1</version></rdbms>
-
-<fullquery name="grant">      
-      <querytext>
-
-    select acs_permission__grant_permission(:object_id, :party_id, :privilege)
-
-      </querytext>
-</fullquery>
-
- 
-</queryset>
Index: openacs-4/packages/acs-subsite/www/permissions/grant-2.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/acs-subsite/www/permissions/Attic/grant-2.tcl,v
diff -u -N
--- openacs-4/packages/acs-subsite/www/permissions/grant-2.tcl	17 May 2003 10:02:04 -0000	1.3
+++ /dev/null	1 Jan 1970 00:00:00 -0000
@@ -1,23 +0,0 @@
-# packages/acs-core-ui/www/acs_object/permissions/grant-2.tcl
-
-ad_page_contract {
-
-  @author rhs@mit.edu
-  @creation-date 2000-08-20
-  @cvs-id $Id: grant-2.tcl,v 1.3 2003/05/17 10:02:04 jeffd Exp $
-} {
-  object_id:integer,notnull
-  party_id:integer,notnull
-  privilege
-  {application_url ""}
-}
-
-ad_require_permission $object_id admin
-
-db_exec_plsql grant {
-  begin
-    acs_permission.grant_permission(:object_id, :party_id, :privilege);
-  end;
-}
-
-ad_returnredirect "one?[export_vars {object_id application_url}]"
Index: openacs-4/packages/acs-subsite/www/permissions/grant-oracle.xql
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/acs-subsite/www/permissions/Attic/grant-oracle.xql,v
diff -u -N -r1.2 -r1.3
--- openacs-4/packages/acs-subsite/www/permissions/grant-oracle.xql	17 May 2003 10:02:04 -0000	1.2
+++ openacs-4/packages/acs-subsite/www/permissions/grant-oracle.xql	29 Sep 2003 14:53:37 -0000	1.3
@@ -5,21 +5,27 @@
 
 <fullquery name="name">      
       <querytext>
-      select acs_object.name(:object_id) from dual
+      select acs_object.name(:object_id) 
       </querytext>
 </fullquery>
 
- 
-<fullquery name="parties">      
+<fullquery name="select_privileges_hierarchy">      
       <querytext>
-      
-  select p.party_id, 
-         acs_object.name(p.party_id) || nvl2(p.email, ' ('||p.email||')', '') as name
-  from   parties p
-  order  by upper(acs_object.name(p.party_id))
+          select privilege, child_privilege
+          from acs_privilege_hierarchy
+      </querytext>
+</fullquery>
 
+<fullquery name="grant">      
+      <querytext>
+          select acs_permission.grant_permission(:object_id, :party_id, :privilege)
       </querytext>
 </fullquery>
 
+<fullquery name="revoke">      
+      <querytext>
+        select acs_permission.revoke_permission(:object_id, :party_id, :privilege)
+      </querytext>
+</fullquery>
  
 </queryset>
Index: openacs-4/packages/acs-subsite/www/permissions/grant-postgresql.xql
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/acs-subsite/www/permissions/Attic/grant-postgresql.xql,v
diff -u -N -r1.3 -r1.4
--- openacs-4/packages/acs-subsite/www/permissions/grant-postgresql.xql	17 May 2003 10:02:04 -0000	1.3
+++ openacs-4/packages/acs-subsite/www/permissions/grant-postgresql.xql	29 Sep 2003 14:53:37 -0000	1.4
@@ -1,5 +1,4 @@
 <?xml version="1.0"?>
-
 <queryset>
    <rdbms><type>postgresql</type><version>7.1</version></rdbms>
 
@@ -9,17 +8,25 @@
       </querytext>
 </fullquery>
 
- 
-<fullquery name="parties">      
+<fullquery name="select_privileges_hierarchy">      
       <querytext>
-      
-  select p.party_id, 
-         acs_object__name(p.party_id)|| coalesce(' ('||p.email||')', '') as name
-  from   parties p
-  order  by upper(acs_object__name(p.party_id))
+          select p.privilege, tree_level(h.tree_sortkey) as level
+          from acs_privileges p
+          left join acs_privilege_hierarchy_index h on p.privilege=h.privilege
+          order by h.tree_sortkey
+      </querytext>
+</fullquery>
 
+<fullquery name="grant">      
+      <querytext>
+          select acs_permission__grant_permission(:object_id, :party_id, :privilege)
       </querytext>
 </fullquery>
 
+<fullquery name="revoke">      
+      <querytext>
+        select acs_permission__revoke_permission(:object_id, :party_id, :privilege)
+      </querytext>
+</fullquery>
  
 </queryset>
Index: openacs-4/packages/acs-subsite/www/permissions/grant.adp
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/acs-subsite/www/permissions/grant.adp,v
diff -u -N
--- /dev/null	1 Jan 1970 00:00:00 -0000
+++ openacs-4/packages/acs-subsite/www/permissions/grant.adp	29 Sep 2003 14:53:37 -0000	1.1
@@ -0,0 +1,64 @@
+<master>
+<property name="title">@title@</property>
+<property name="context">@context@</property>
+
+
+<formtemplate id="grant">
+<formwidget id="object_id">
+<formwidget id="application_url">
+<table>
+  <tr valign="center">
+    <td>Grant: </td>
+
+    <td>&nbsp;</td>
+
+    <td>
+
+      <table border="0">
+        @first_tr;noquote@
+        <multiple name="mu_privileges">
+        <tr>
+          <td colspan="@mu_privileges.level@">&nbsp;&nbsp;&nbsp;</td>
+          <td colspan="@mu_privileges.inverted_level@">
+            <input type="checkbox" name="privileges" value="@mu_privileges.privilege@" @mu_privileges.selected@>@mu_privileges.privilege@</input>
+          </td>
+        </tr>
+        </multiple>
+      </table>
+
+    </td>
+
+    <td>&nbsp;</td>
+
+    <td>on @name@ to:</td>
+
+    <td>&nbsp;</td>
+
+    <td>
+      <formwidget id="party_id"></formwidget>
+      <if @formerror.party_id@ not nil>
+      <br><formerror id="party_id"></formerror>
+      </if>
+    </td>
+
+    <td>&nbsp;</td>
+
+    <td>
+      <input type="submit" value="OK">
+    </td>
+
+  </tr>
+
+</table>
+
+</formtemplate>
+
+<p>
+
+<p>
+
+<i>Notes:</i>
+<br>
+<i>Privileges higher in the hierarchy imply all the privileges below, e.g. when you grant admin, then read, write etc. are implied automatically.</i>
+<br>
+<i>When you leave a checkbox empty here then that privilege will be revoked from the party you choose in case it has been granted to that party before.</i>
Index: openacs-4/packages/acs-subsite/www/permissions/grant.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/acs-subsite/www/permissions/grant.tcl,v
diff -u -N -r1.4 -r1.5
--- openacs-4/packages/acs-subsite/www/permissions/grant.tcl	17 May 2003 10:02:04 -0000	1.4
+++ openacs-4/packages/acs-subsite/www/permissions/grant.tcl	29 Sep 2003 14:53:37 -0000	1.5
@@ -2,53 +2,179 @@
 
 ad_page_contract {
 
-  @author rhs@mit.edu
-  @creation-date 2000-08-20
-  @cvs-id $Id$
+    @author rhs@mit.edu
+    @creation-date 2000-08-20
+    @cvs-id $Id$
 } {
-  object_id:integer,notnull
-  {application_url ""}
+    object_id:integer,notnull
+    privileges:multiple,optional
+    {application_url ""}
 }
 
 ad_require_permission $object_id admin
 
 # The object name is used in various localized messages below
 set name [db_string name {select acs_object.name(:object_id) from dual}]
 
-doc_body_append "[ad_header "[_ acs-subsite.lt_Grant_Permission_on_n]"]
+set title [_ acs-subsite.lt_Grant_Permission_on_n]
 
-<h2>[_ acs-subsite.lt_Grant_Permission_on_n]</h2>
+set context [list [list one?[export_url_vars object_id] "[_ acs-subsite.Permissions_for_name]"] [_ acs-subsite.Grant]]
 
-[ad_context_bar [list ./?[export_url_vars object_id] "[_ acs-subsite.Permissions_for_name]"] "[_ acs-subsite.Grant]"]
-<hr>
 
-<form method=get action=grant-2>
-[export_vars -form {application_url object_id}]
+set existing_privs [list]
+set hierarchy [list]
+set maxlevel 1
 
-<input type=submit value=\"[_ acs-subsite.Grant]\">
 
-<select name=privilege>
-"
-db_foreach privileges {} {
-  doc_body_append "<option value=$privilege>$privilege</option>\n"
+# Fill a multirow that contains a hierarchical tree representation of
+# the acs_privileges.
+
+if { [db_type] == "oracle" } {
+    # Unfortunately it is not possible to write a query that returns
+    # all the desired data with the current datamodel consisting of
+    # only the tables acs_privileges and acs_privilege_hierarchy. This
+    # is partly due to the restriction that a JOINed query cannot deal
+    # with CONNECT BY in oracle 8i. See
+    # http://openacs.org/forums/message-view?message_id=125969 for the
+    # gory details. That's why this page resorts to a hack and builds
+    # the tree structure manually in tcl. (-til)
+
+    set existing_privs [db_list select_privileges_list { }]
+    
+    # Initialize the $hierarchy datastructure which is a list of
+    # lists. The inner lists consist of two elements: 1. level,
+    # 2. privilege
+    foreach privilege $existing_privs {
+        lappend hierarchy [list 0 $privilege]
+    }
+
+    # Loop through each row in acs_privilege_hierarchy and shuffle the
+    # $hierarchy list accordingly.
+    db_foreach select_privileges_hierarchy { } {
+
+        if { [set start_pos [lsearch -regexp $hierarchy "\\m$child_privilege\\M"]] == -1 } {
+            # child_privilege of this relation not in privileges - skip.
+            continue
+        }
+        if { [lsearch -regexp $hierarchy "\\m$privilege\\M"] == -1 } {
+            # privilege of this relation not in privileges - skip.
+            continue
+        }
+
+        # the level of the first privilege element that we move
+        set start_pos_level [lindex [lindex $hierarchy $start_pos] 0]
+
+        # find the end position up to where the block extends that we have
+        # to move
+        set end_pos $start_pos
+        for { set i [expr $start_pos + 1] } { $i <= [llength $hierarchy] } { incr i } {
+            set level [lindex [lindex $hierarchy $i] 0]
+            if { $level <= $start_pos_level } {
+                break
+            }
+            incr end_pos
+        }
+
+        # cut out the block
+        set block_to_move [lrange $hierarchy $start_pos $end_pos]
+        set hierarchy [lreplace $hierarchy $start_pos $end_pos]
+
+        if { [set target_pos [lsearch -regexp $hierarchy "\\m$privilege\\M"]] == -1 } {
+            # target not found, something is broken with the
+            # hierarchy. insert the block back to where it was
+            eval "set hierarchy \[linsert \$hierarchy $start_pos $block_to_move\]"
+            continue
+        }
+        set target_level [lindex [lindex $hierarchy $target_pos] 0]
+
+        # insert the block to the new position, looping through the block
+        foreach element $block_to_move {
+            incr target_pos
+            set level_to_move [expr [lindex $element 0] + $target_level + 1]
+            set privilege_to_move [lindex $element 1]
+            set hierarchy [linsert $hierarchy $target_pos [list $level_to_move $privilege_to_move]]
+
+            if { $maxlevel < $level_to_move } { set maxlevel $level_to_move }
+        }
+    }
+
+} else {
+    # We are not on oracle - use the table
+    # acs_privilege_hierarchy_index.
+
+    db_foreach select_privileges_hierarchy { } {
+        if { [lsearch $existing_privs $privilege] > -1 } {
+            # skip double entries
+            continue
+        } else {
+            lappend existing_privs $privilege
+            lappend hierarchy $level $privilege
+        }
+
+        if { $level > $maxlevel } {
+            set maxlevel $level
+        }
+    }
+
+    incr maxlevel
 }
 
-doc_body_append "
-</select>
-[_ acs-subsite.on] $name [_ acs-subsite.to]
-<select name=party_id>
-"
 
-db_foreach parties {} {
-  doc_body_append "<option value=$party_id>$name</option>\n"
+multirow create mu_privileges privilege level inverted_level selected
+
+# Preserve checked value of the privilege checkboxes for re-submitted
+# form status.
+foreach { level privilege } $hierarchy {
+    if { [info exists privileges] && [lsearch $privileges $privilege]>-1 } {
+        set selected "CHECKED"
+    } else {
+        set selected ""
+    }
+    multirow append mu_privileges $privilege $level [expr $maxlevel - $level] $selected
 }
 
-doc_body_append "
-</select>
+for { set i 0 } { $i < $maxlevel } { incr i } {
+    append first_tr "<td>&nbsp;&nbsp;&nbsp;</td>"
+}
 
-<input type=submit value=\"      OK      \">
+form create grant
 
-</form>
+element create grant object_id \
+    -widget hidden \
+    -value $object_id
 
-[ad_footer]
-"
+element create grant application_url \
+    -widget hidden \
+    -value $application_url \
+    -optional
+
+element create grant party_id \
+    -widget party_search \
+    -datatype party_search \
+    -optional
+
+
+if { [form is_valid grant] } {
+    # A valid submission, grant and revoke accordingly.
+
+    form get_values grant
+
+    if { ![info exists privileges] } {
+        # no privilege was selected
+        set privileges [list]
+    }
+
+    # loop through all privileges, grant checked and revoke un-checked
+    # (assuming that there are not too many privs in total, otherwise
+    # this would be slow)
+    foreach privilege $existing_privs {
+        if { [lsearch $privileges $privilege] > -1 } {
+            db_exec_plsql grant { }
+        } else {
+            db_exec_plsql revoke { }
+        }
+    }
+    
+    ad_returnredirect "one?[export_url_vars object_id]"
+}
+
Index: openacs-4/packages/acs-subsite/www/permissions/grant.xql
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/acs-subsite/www/permissions/grant.xql,v
diff -u -N -r1.1 -r1.2
--- openacs-4/packages/acs-subsite/www/permissions/grant.xql	30 Apr 2001 22:02:48 -0000	1.1
+++ openacs-4/packages/acs-subsite/www/permissions/grant.xql	29 Sep 2003 14:53:37 -0000	1.2
@@ -1,7 +1,7 @@
 <?xml version="1.0"?>
 <queryset>
 
-<fullquery name="privileges">      
+<fullquery name="select_privileges_list">      
       <querytext>
       
   select privilege