TYPO3 Core

It would be really helpful to be able to define user rights in files. This way they can be version controlled, moved from one project to the next one and ideally be split in multiple files (e.g. per extension). Extensions could even deliver some tested default configurations.

In TypoScript, the syntax could look like this, in userTS:

userRights {
    allowModules {
        web = 1
        web.page = 1
        web.list = 0
    }

    allowSelectTable {
        tt_content = 1
        backend_layouts = 0
    }

    allowUpdateTable {
        [...]
    }

    allowPageTypes {
        [...]
    }

    allowExcludeFields {
        tt_content {
            title = 1
            text_color = 0
        }
    }

    explicitAllowDeny {
        header = 1
        form = 0
    }

    # Only languages with ids 0, 2 and 3
    restrictToLanguages = 0,2,3
}

I'm not sure how this should interact with the current database driven user permission system. I have two ideas:

1. The permissions defined in TypoScript are overwritten by permissions from the database. Since there is no option "not specified" in the permission system, it would be necessary to introduce such a setting per permission in the backend (e.g. as an extra checkbox). Otherwise the permission definitions from TS would always be completely overwritten by the ones from the database. This approach is consistent with the settings priorization from plugin flexforms.
2. The permissions defined in TypoScript overwrite the permissions set in the backend. This would probably be simpler to implement, but it is inconsistent with the flexform handling.