Space restrictions incongruent with space permissions

Candice Holland

There appears to be a discrepancy between space restrictions and space permissions that is causing an issue with using a plug-ins conversion tool.

I've added the necessary/relevant user to space permissions with full access but was receiving an error saying the space was restricted. Confirmed that the space was not restricted. 

Attempted to then place restrictions on the space; self as admin and the user for the conversion tool with edit access. But this modal shows that the user "Needs access to the space first". If this user is already granted full permission to the space, why is this message showing? This error appears to be perpetuating the failures with the conversion tool due to incongruence between space restriction and space permission. 

If I grant anonymous access, then the conversion tool is successful so this does not appear to be an issue with the conversion tool. Possible caching issue? Any suggestions for how to fix this

Nic Brough -Adaptavist-

Welcome to the Atlassian Community!

You are confusing what permissions and restrictions do.  They are not combined, they are layered, and they work on different levels.

Permissions work at a space level.  They tell Confluence that a user has access to every page in the space to do something (view, edit, comment, attach, etc).

Restrictions work at a page and child level, and they only apply to view and edit access.

• A restriction does *not* grant more permission to a user, the space permissions are all that is considered. 
• An edit restriction applies to an individual page, it says "only these people can edit the page".  Those people must also have the space permission to edit.
• A view restriction cascades down.  It says "only these people can see the page, and all of the pages below it in the tree".  Again, these people must also have the space permission to view the space.

Anonymous access is another layer and can be counter-intuitive (although technically correct).  All of the space permissions and restrictions work by identifying the user and applying rules to what they are able to do.  But, by definition, you cannot identify an anonymous user, so you cannot apply the rules to them. 

So, while restrictions work as you'd expect (I do not know who you are, so I cannot see if you match the rule that lets you see this page, so you can't see/edit it), you can end up with an odd-looking case where someone can read pages in a space without logging in, but once they log in, they can not see the space!  If you are going to make a space anonymously accessible, you should always change its space permission so that "all logged-in users" can view it as well.