Restict admin user permissions to only editing users he/she has created.

Question

I'm thinking about building an app with Craft that requires users from a specific user group (Business User Usergroup) to be able to log in on the frontend and add users from another user group (Client Usergroup) from the frontend, these users would be their clients and they would be able to view information set by the admin aswell as upload certain documents that they admin can then view.

// If anyone is interested the application will be a portal where coaches/therapists can register, log in and become a user( of the business user Usergroup) and can then add their clients as users (Client Usergroup) and then they can communicate digitally before meeting. Obviously, i don't want therapists to be able to see clients that don't belong to them. For this, i need to restrict user permissions as to make sure that the therapist can only see and edit users/clients that belong to him.

What i cant seem to figure out is if there is a way either with Craft or a plugin that makes sure that the admin cannot edit/see users added by other users in their user group. This means that if a user/coach from the Business Usergroup logs in and adds a client/user (from the Client Usergroup) only he/she, all super users and the client he added can login, view and edit these account details.

Has anyone come across a plugin or have experience with this type of "user-specific" bound user permission? If the explanation is too vague or unclear then i would be happy to explain in more detail. Hope someone can help with this and thanks in advance!

Answer 1

I believe what you're looking for is 'isInGroup'

{% if currentUser.isInGroup('groupHandle') %}

It will also accept an actual group object or a group ID as well.

There is also getGroups:

{{ entry.author.getGroups() }}

So you have several options:

1. If all users only have one group (so they can not be in two) you can check if the current user is in the same group like the first group of entry.author. But this has the disadvantage if someone wants to change his/her group the entry will become invisible for the previous group
2. You could attach the group handle to an entry. So you field create a plainTextField and insert the group handle of the author to this entry -> if the author changes his/her group the entry will still be available for the author as well as everyone who was able to see the entry before.

If you choose the second option you would be able to include the search condition in a ElementCriteriaModel very smooth. And search only entry that is connected by the current group of the currentUser. If someone should be able to see entries but he/she is not allowed to edit them you would just include the isInGroup condition to check if she/he may proceed.

For example your user list could look like that

{% set users = craft.users.find() %}
{% for user in users %}
    <!-- everyone can see the firstName of each user -->
    {{ user.firstName }} 
    {% if currentUser %}
        <!-- but only logged in users can see the last name -->
        {{ user.lastName }}
        {% set groupsOfUser = user.getGroups() %}
        {% if groupsOfUser|length %}
            {% if currentUser.isInGroup(groupsOfUser[0]) %}
                <!-- only users of the same group can edit/delete or whatever -->
            {% endif %}
        {% endif %}
    {% endif %}
{% endfor %}