How would one allow users to edit only some other users entries but not all? Linked via a related field

Question

I have users that are assigned to an organisation. An organisation can have many users.

I would like users within the same organisation to be able edit entries (in this case projects) created by a "parent" user in that organisation.

I could allow users to edit other users entries, and code into the template a check if they are not in the project's organisation then dont allow them to edit it, but this is not fool proof because someone could change the hidden project ID fields in the HTML and therefore could save an entry for another organisation.

Anyone have any ideas how best to accomplish the above?

Thanks

Answer 1

I managed to implement it, don't know if it's the best way. Ideally I would like to disallow users to edit other entries, then in the EVENT_BEFORE_SAVE grant permissions, but I think the permissions are being checked before EVENT_BEFORE_SAVE so I could not find a way to tap into it before then.

Therefore I have granted the user permissions to edit other users entries, then the following code will check if the user is in the same organisation, and if they are not set the event isValid to false, which stops it saving.

Event::on(
Entry::class,
Entry::EVENT_BEFORE_SAVE,
function(Event $event)
{
    // Only do it on front end
    if (Craft::$app->request->isSiteRequest)
    {
        // Get Entry Data
        $entry = $event->sender;

        // Only call it if its sectionId 1 = Projects or 22 = KPIs
        if( $entry->sectionId == 1 || $entry->sectionId == 22)
        {
            // Entry Organisation ID
            $entry_organisation_id = $entry->client->id[0];

            // User Organisation ID
            $user = Craft::$app->getUser()->getIdentity();
            $user_organisation_id = $user->getFieldValue('organisation')->first()->id ;

            if($user_organisation_id != $entry_organisation_id)
            {
                // Disallow!
                $event->isValid = false;
            }

        }
    }
}

);

Code goes into a plugin init() function I have for my site.