Restrict Permissions Per Entry Rather Than Per Section

Question

Working in Craft 3, I have a requirement to restrict user access (in the CP) per Entry rather than per Section.

In this case Users in Craft will belong to Department (Channel) and Resources (Channel). They should only be able to administer the Entries in those Channels for which they are responsible.

I suppose the ideal would be to create a User Group per Department and then be able to select the individual Entries within the Department & Resources Channels here:

Is that possible via a Module/Plugin and if so can anyone provide any pointers on how to get started? I presume I'd need to loop through all Entries in the Channels and output them in this list to be selectable and then have access permissions applied. Any examples or pointers would be appreciated.

Any other suggestions or workarounds also welcome.

Thanks

Answer 1

There is a way - it's actually quite easy but you need to dig deep into Craft 3 to do it. In general: there is only one single Javascript function that fetches all elements for all index pages

updateElements: function() {
    // Ignore if we're not fully initialized yet
    if (!this.initialized) {
        return;
    }

    this.setIndexBusy();

    var params = this.getViewParams();

    Craft.postActionRequest(this.settings.updateElementsAction, params, $.proxy(function(response, textStatus) {
        this.setIndexAvailable();

        if (textStatus === 'success') {
            this._updateView(params, response);
        }
        else {
            Craft.cp.displayError(Craft.t('app', 'An unknown error occurred.'));
        }

    }, this));
},

As you can see: the route is a variable in the defaults

updateElementsAction: 'element-indexes/get-elements'

In order to change this route you'll have to overwrite it in a JS file

Craft.BaseElementIndex.defaults.updateElementsAction = 'your-awesome-plugin-route';

Not let's take a look at the controller: After certain other functions the final call that searches for all elements is the following ElementIndexController line 379

$responseData['html'] = $elementType::indexHtml(
    $this->_elementQuery,  // <-- this is the important part
    $disabledElementIds,
    $this->_viewState,
    $this->_sourceKey,
    $this->_context,
    $includeContainer,
    $showCheckboxes
);

All you have to do is to extend this Controller, build a custom one, link the route to your custom controller and change the $this->_elementQuery. You can include your custom search parameters, include hidden content fields, create custom relation fields for groups and search for elements related to this user group or whatever you want.

It seems a little bit tricky at first but it's actually pretty easy. I've done it several times

Answer 2

I had a similar problem where I needed to manage national and regional users groups where regional users should only see their own content. I didn’t like the idea of overriding the whole ElementIndexesController controller as most of its properties and methods are private and that could impede upgrades to Craft.

I managed to have this work by using ElementQuery::EVENT_BEFORE_PREPARE in my site module.

Regional content is assigned a region category with an attribute (numeroRegion) that match the last 2 characters of the regional group handle (ex.: "01").

Note that I’m using the Collections plugin to filter and map the groups.

if ($user && $user->id && !$user->identity->admin && $request->getIsCpRequest()) {
  Event::on(ElementQuery::class, ElementQuery::EVENT_BEFORE_PREPARE, function(Event $event) use ($user) {

    if ($event->sender->elementType === 'craft\elements\Entry') {
        $userGroups = Collections::$plugin->collectionsService->collect(Craft::$app->userGroups->getGroupsByUserId($user->id));
      $isNational = $userGroups->filter(function($group) {
        return (int)$group->id === 1;
      })->isNotEmpty();

      if (!$isNational) {
        $userRegionGroups = $userGroups->map(function($group) {
          return substr($group->handle, -2);
        });
        $regions = Category::find()->numeroRegion($userRegionGroups)->all();
        Craft::configure($event->sender, [
          'relatedTo' => [
            'element' => $regions
          ]
        ]);
      }
    }
  });
}

Disclaimer: it works, but this is my first attempt at this kind of hack, and it may have side effects I haven’t noticed yet.