It looks like the setup of roles was correct, however the way permission was given was incorrect. I will detail the correct way here as I don't think it's very clear from google searches currently.
First of all, sitecore\Sitecore Client Users
is the minimum necessary for a new user to be able to login, the new custom role should implement this or any role that inherits from it (such as sitecore\Content Editor
).
Now to stop all base permissions: go to the custom role and allow read for the top level "sitecore" item AND deny read for descendants. This can't be achieved on the GUI table, you must instead click the button Assign
on the top bar.
Now from here you can build up. As a rule of thumb, you should mostly allow read/write for the item only (such as the webpage) via the Assign
button and not allow read/write for descendants (no need to deny, just leave the tick/cross empty for the descendants). Since you have read denial set on the top level sitecore item, it will flow down to all children. The reason for allowing read for the webpage only and not descendants: so that child webpages don't automatically get the read permission. Then you can do a full read permission on the Page Content
item of that webpage.
This has solved most of my requirements/issues. Then I got a mysterious issue with 2 very similar roles that should behave the same but they don't. The folders Layout
, System
and Templates
were showing in one and not the other. I installed the Security Rights Reporting module to see if there was a difference causing this (https://github.com/jbluemink/Sitecore-Security-Rights-Reporting), running it on both users and both custom roles. Nothing came up. Then I came across this page (https://doc.sitecore.net/sitecore_experience_platform/content_authoring/the_editing_tools/the_content_editor/customize_the_content_editor), the difference was that while logged in to the user, you can hide hidden items
in the content editor (log in to user > Content Editor > top left Red menu button > Application options > Untick Hidden items
).
Hope this helps someone!