What's the best way to create a multiple account architecture?

Question

(I have a lot of experience with custom PHP and JS code and multiple frameworks and a few CMS's, but little experience with Craft.)

I'm working on a site and they want to have multiple accounts and admins and users that fit in that paradigm, and I'm not sure the best way to approach it.

So general admins should be able to create new accounts and account admins. Account admins can log in and add products for their account only. And then the regular site is locked behind a login so that "regular" users must log in and be associated with an account and can. Both Account Admins and General Admins should be able to create "regular" users (but the former for their accounts only).

I was maybe thinking of associating extra fields to User Groups and trying to go at it in that route. I see you can edit User Profiles with Pro, but I don't see a way to customize User Groups (maybe we don't fully need that, but maybe just let those general admins create User Groups (can this be renamed "Accounts?").

I realize this is a bit of a vague/open ended question. Maybe this isn't really practical in Craft, or will need a lot of custom work...? Or maybe someone has a plugin with this in mind? Just looking for some general help, and this seemed like the place to start!

Answer 1

Not exactly the fine control you're looking for, or ideal by any means, but one direction might be to create an "Account" channel with a related user field for 'User' (required; limit to 1; from userGroup 'Regular User') — or vice-versa (related "Account" entry in "Users").

You can then restrict your Account Admins to only edit 'Accounts' (and Products) entries that belong to them, with all the custom fields that are required.

The problem here is that you wouldn't also want the Account Admin to be able to edit or assign permissions to users (thus defeating the purpose). And there is no way to automatically assign a new user (created through the CP) to a userGroup (as far as I know). Users can however automatically be assigned through the front-end through "allow public registration" and "default user group" settings. So, an Account Admin could technically create a new user through the front-end. And then (back in the CP) create a new 'Account' entry, and relate that account to the user they just created.

They would still require an admin to edit or delete the user, but maybe that's ok.

You would also need checks in place to ensure that only one account was assigned to any one user, somehow. If you reverse the relationship (i.e. related 'Account' entries field in 'Users'; limit 1), then you could ensure the 1-to-1, but this would require an admin to relate the two together.

Admins, of course, could do all of this through the CP and assign the "Account" to the Account Admin, by just setting the author.

Not ideal of course, but perhaps a step in the right direction.