https://www.npmjs.com/package/apostrophe-pieces-submit-widgets
I'm making a user submit form, but I totally do not understand permissions.
As I understand here: apostrophe-permissions part will give public right to edit every attachment on project, because there are no connection of apostrophe-permission and apostrophe-events here.
edit-attachment grants the user the ability to set the value of an attachment field by uploading a file, but they must also have access to the doc the attachment field is a part of to actually do anything sensitive, and this permission does not give them that.
The submit-widgets module skips permissions when inserting the submitted piece but does so without granting any other permissions for that piece or type of piece.
If you don't care about allowing the public to attach images or PDFs to a piece when submitting, then you don't need to worry about this at all.
