Upgrade steps (workflow security update, Subfolder publishing)

src/pfwbged/policy/configure.zcml

@@ -72,6 +72,8 @@
 
     <include package="collective.monkeypatcher" />
 
+    <include package=".upgrades" />
+
     <monkey:patch
         description="Always ignore browser-supplied MIME type"
         class="plone.namedfile.file.NamedBlobFile"

src/pfwbged/policy/upgrades/configure.zcml

@@ -0,0 +1,22 @@
+<configure
+    xmlns="http://namespaces.zope.org/zope"
+    xmlns:genericsetup="http://namespaces.zope.org/genericsetup"
+    i18n_domain="pfwbged.policy">
+
+  <genericsetup:upgradeStep
+      title="Publish document subfolders"
+      description="Allows use of Delete Objects permission on folder contents"
+      source="1"
+      destination="2"
+      handler=".workflow.publish_document_subfolders"
+      profile="pfwbged.policy:default" />
+
+  <genericsetup:upgradeStep
+      title="Update role mappings"
+      description="Updating security settings after changing workflow"
+      source="2"
+      destination="3"
+      handler=".workflow.update_role_mappings"
+      profile="pfwbged.policy:default" />
+
+</configure>

src/pfwbged/policy/upgrades/workflow.py

@@ -0,0 +1,24 @@
+from Products.CMFCore.utils import getToolByName
+from plone import api
+
+
+def update_role_mappings(context):
+    wf_tool = getToolByName(context, 'portal_workflow')
+    wf_tool.updateRoleMappings()
+
+
+def publish_document_subfolders(context):
+    portal = api.portal.get()
+    if 'documents' in portal:
+        portal_catalog = api.portal.get_tool('portal_catalog')
+        folder_path = '/'.join(portal['documents'].getPhysicalPath())
+        query = {'path': {
+            'query': folder_path},
+            'review_state': 'private'}
+        results = portal_catalog.searchResults(query)
+        for brain in results:
+            subfolder = brain.getObject()
+            api.content.transition(
+                obj=subfolder,
+                transition="publish"
+            )