If I create an Organic Groups group node, MyGroup (nid=1234), and a content type, "Posts", that is set up for use as group content, what should the necessary permissions be to allow, for example, an anonymous user to create a Posts node in the MyGroup group?
I have seen writeups that imply all permutations of permission combinations, and also theoretically-fixed bug reports that imply things without any general rule in writing.
I know what appears to be current reality, as of 2.7 anyway, which is that I have to give the Drupal role "Anonymous" the permission "Posts: Create new content", and then also give the OG membership type "non-member" the permission "Create Posts content".
If I only specify the OG permission, the user gets an Access Denied error trying to load the /node/add/posts?og_group_ref=1234 form. If I only specify the Drupal role permission, the user has no problem loading that form and creating a node - but the node will not be in the MyGroup group. The only way to prevent the node creation is to make the group audience field (og_group_ref) required and hidden, so that if the prepopulated value from the URL isn't accepted, the field has no value, and so fails the required-field test.
Is this how it is supposed to work?
