I need to declare an editorial reviewer-type role that:
- will have access to view unpublished content, and
- does not have node edit permissions to the content types which the role does have the above permission to view.
This seems to work okay for new unpublished node drafts by just granting the Workbench Moderation permission: 'View all unpublished content', but node revision drafts (.../node/123/draft) throw an Access Denied error.
It seems that it is not currently possible to set up a view-only, role-based user access allowance using the Workbench config settings and the combined Node and Workbench permissions grant options.
The only option that I can figure out are that in order for a role to be able to access an unpublished node revision draft page, it must have the permission 'Node -> [content type] -> Edit any content', which essentially strips the read-only, view all unpublished restriction/allowance.
The question is: Does anyone know of an existing methodology or solutions option for achieving the desired result of configuring a user role that has view/read-only permissions allowance of in a Workbench moderated environment?
I can think of several 'right way' approaches, from custom code-based Rules implementation to some invasive custom module API intervention, as well a some hacky shortcuts that are most definitely 'not the right way', but I was just hoping that someone may have some insight into something obvious that I am overlooking or a solution that has been done already that could be twiddled with.
The only thing that I could find on d.o the was relatively close was an abandoned, unfinished and overly-complex sandbox project: Workbench State Permissions (https://drupal.org/sandbox/isampo/1955252). This looks like it had some good ideas, but probably was a bit over too much in implementation.