1

I'm thinking about building an app with Craft that requires users from a specific user group (Business User Usergroup) to be able to log in on the frontend and add users from another user group (Client Usergroup) from the frontend, these users would be their clients and they would be able to view information set by the admin aswell as upload certain documents that they admin can then view.

// If anyone is interested the application will be a portal where coaches/therapists can register, log in and become a user( of the business user Usergroup) and can then add their clients as users (Client Usergroup) and then they can communicate digitally before meeting. Obviously, i don't want therapists to be able to see clients that don't belong to them. For this, i need to restrict user permissions as to make sure that the therapist can only see and edit users/clients that belong to him.

What i cant seem to figure out is if there is a way either with Craft or a plugin that makes sure that the admin cannot edit/see users added by other users in their user group. This means that if a user/coach from the Business Usergroup logs in and adds a client/user (from the Client Usergroup) only he/she, all super users and the client he added can login, view and edit these account details.

Has anyone come across a plugin or have experience with this type of "user-specific" bound user permission? If the explanation is too vague or unclear then i would be happy to explain in more detail. Hope someone can help with this and thanks in advance!

1

I believe what you're looking for is 'isInGroup'

{% if currentUser.isInGroup('groupHandle') %}

It will also accept an actual group object or a group ID as well.

There is also getGroups:

{{ entry.author.getGroups() }}

So you have several options:

  1. If all users only have one group (so they can not be in two) you can check if the current user is in the same group like the first group of entry.author. But this has the disadvantage if someone wants to change his/her group the entry will become invisible for the previous group
  2. You could attach the group handle to an entry. So you field create a plainTextField and insert the group handle of the author to this entry -> if the author changes his/her group the entry will still be available for the author as well as everyone who was able to see the entry before.

If you choose the second option you would be able to include the search condition in a ElementCriteriaModel very smooth. And search only entry that is connected by the current group of the currentUser. If someone should be able to see entries but he/she is not allowed to edit them you would just include the isInGroup condition to check if she/he may proceed.

For example your user list could look like that

{% set users = craft.users.find() %}
{% for user in users %}
    <!-- everyone can see the firstName of each user -->
    {{ user.firstName }} 
    {% if currentUser %}
        <!-- but only logged in users can see the last name -->
        {{ user.lastName }}
        {% set groupsOfUser = user.getGroups() %}
        {% if groupsOfUser|length %}
            {% if currentUser.isInGroup(groupsOfUser[0]) %}
                <!-- only users of the same group can edit/delete or whatever -->
            {% endif %}
        {% endif %}
    {% endif %}
{% endfor %}
  • I dont think that this is what iam looking for. This would still allow users from the business usergroup too see other users that they themselves did not add aswell as give them access to users client usergroup that they are not coaching/dealing with. This means that users from the business user group would be able to see other users in that user group. Seeing as each user in this user group is a separate coach/therapist with their own practice i don't want to have them see people that don't "belong" to them/ have nothing to do with them. I really appreciate the help though! – Gįëł Tėttëłæår Nov 21 '17 at 19:02
  • Then it is not about user groups but about users related to other users. You can include a relationfield to your parent users and add children to them. You would check if the current user is related to the "admin" of the group – Robin Schambach Nov 21 '17 at 19:13
  • Damm youre right! Sorry I am new to craft. I looked at the relation field and played areound abit. Exactly what i need! Thanks! – Gįëł Tėttëłæår Nov 22 '17 at 22:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.