Working Groups

A complete guide to managing BAB Working Groups (CPT), assigned member permissions, server-isolated physical storage, and the secure file streaming engine.

1. Working Groups in the Admin Sidebar

To view existing working groups or add new committees, navigate to workgroups in the WordPress admin menu.

From this overview screen, administrators can manage working group descriptions, volunteer lists, meeting schedules, and general committee settings.

2. Automated Group Creation & Member Assignment

Working groups are tied directly to user profiles:

• Auto-Registration: When editing a user profile (Users → All Users), typing a new working group name into the bab_workgroup datalist automatically creates and publishes that workgroup CPT entry.
• Single Assignment: Members are linked to their specific working group via user metadata, determining their frontend access permissions.

3. Frontend Route Protection & Access Isolation

The platform strictly gates access to working group pages:

• Non-Logged-In Users: Automatically redirected to the WordPress login screen.
• Subscribers & General Public: Redirected away to the homepage with access restricted.
• Active Members: When visiting /workgroups/, members are automatically routed to their assigned working group. Accessing another group results in a secure 403 Access Denied screen.
• Admins & Editors: Retain full bypass rights to view and oversee all working groups.

4. Server-Isolated Physical Storage & File Streaming

To ensure internal meeting minutes, slide decks, and confidential documents remain private, the platform uses an isolated file storage architecture:

Physical Directory Structure & .htaccess Shield

Upon publishing any working group, a physical server directory is created at:

/wp-content/uploads/workgroups/{group-slug}/

This directory is protected by a server-level .htaccess rule (Require all denied), blocking all direct public URL requests and scrapers.

Secure Streaming Engine

Authorized members stream files through the internal proxy route:

/secure-wg-file/{group-slug}/{filename}

The engine verifies that the active session matches the group assignment, sanitizes against directory traversal attacks, and streams the file securely with dynamic MIME headers.

5. Dashboard REST Uploads

Internal files can be uploaded directly from the member dashboard via the REST API endpoint (POST /wp-json/conpacts/v1/workgroup-upload):

• Max File Size: 100 MB per file.
• Permitted Formats: .pdf, .docx, .pptx, .xlsx, .zip, .jpg, .jpeg, .png, .mp4.
• Filename Sanitization: Automatically handled via wp_unique_filename() to avoid overwriting existing documents.