Restrict viewing front end to specific group permissions

Question

How can I restrict content frontend to specific user groups? There seems no sensible way to do this out of the box. For example group permissions in CP are all about CP - there is no view option.

Never had a use case for this before today but have one now and finding Craft3 coming up short :(

Scenario is a support portal where different companies can provide user specific content. Idea is login with company id (done that ok via a plugin) but then once logged in they get redirected to content for that specific company.

So I have two probs now: redirect to company 'home page', and restrict access to content. I've considered splitting content into sites and pairing users with sites. I've considered section root parent and checking permissions for top of tree in twig. I'm thinking restricting per section is best and adding company homepage as entry field in user field or user group field and managing access via plugin + twig but its all feeling very heavy handed....

Answer 1

If you setup a User Group with the same handle as the Site you want them to have access to, this could be fairly easy.

Let's say you have a site called "Acme" setup in the Sites settings. You also created a corresponding User Group called "Acme." The handles for the Acme Site and Acme User Group are both "acme."

When you're on the Acme site's front-end, possibly example.com/acme depending on how you set up your site URLs, the {{ currentSite.handle }} tag will return acme.

To test if a user has access to content in your template you can use something like {% if currentUser.isInGroup(currentSite.handle) %}.

Adding this to any template will prevent unauthorized access if a user is not in a group:

{% if not currentUser.isInGroup(currentSite.handle) %}  
  {% exit 403 %}
{% endif %}

You would also probably want to allow admins or users groups who can access the control panel:

allow admins:

{% if not currentUser.isInGroup(currentSite.handle) or not currentUser.admin %}  
  {% exit 403 %}
{% endif %}

... or allow any user that can access the control panel:

{% if not currentUser.isInGroup(currentSite.handle) or not currentUser.can('accessCp') %}  
  {% exit 403 %}
{% endif %}

Redirecting to the correct site after a login page is a little trickier because users can belong to more than one group.

But assuming that users only belong to one group you could redirect users to a sort of "routing" template that's only job is to send you to the right place.

{% set firstGroup = currentUser.getGroups()[0] ?? null %}

{% if firstGroup %}
  {% redirect firstGroup.handle %}
{% else %}
  ... default redirect or error 
{% endif %}

Also, here's a list of permission you can use with the currentUser.can() method:

https://docs.craftcms.com/v3/users.html#permissions

Answer 2

I've done this! Let me try to explain without writing a small novel. There were a lot of bits, but it works.

Start by creating a user group for every client. As you create these, write down the group handle. (Note: doesn't need any permissions other than logging in.)

Make a channel containing your clients as individual entries, and in the fields for each entry, add a text field called "Client Portal Handle" - and copy the handle from the user groups to that field.

Then, in my the templates, I'm setting up the page urls to be /portal// - and I set a field (I called it 'associatedClient') on entry, so each entry goes to that client.

And, here's the bit that makes it all work, in a template, it's got code that says:

{% set client = entry.associatedClient.one() %}
{% set cg = client.portalGroup %}

{% if currentUser.admin or currentUser.isInGroup(cg) %}
  {# document template goes here #}
{% else %}
  {# back to the login page #}
{% endif %}

Line 1 gets the client attached to the doc. Line 2 gets the handle attached to the client.

Then the if-check sees if the logged-in user is in that group or they're an admin.

Does that all make sense?

---

Edit: redirecting to the company page.

I've got a generic /portal/ page, and it shows a "Take me to my portal" link, that shows content based on which group a user is in. And then there's some generic contact info and stuff that applies to everyone. This could be better, but it was our solution for the first config.

Answer 3

Hi extending permissions on a group level is a first approach, here is a piece of code that create group permissions for each entry, it would be easy to customize it to allow only top level entries. It is based on cvraft cms extending permissions tutorial https://craftcms.com/docs/4.x/extend/user-permissions.html#requiring-permissions

   
        $entries = \craft\elements\Entry::find() ->all();

Event::on(
                UserPermissions::class,
                UserPermissions::EVENT_REGISTER_PERMISSIONS,
                function (RegisterUserPermissionsEvent $event) use ($entries) {


                 $entryPerms=[];
                    foreach ($entries as $entry) {
                    if ($entry->title)    $entryPerms[  'WaveEntryAccess' . $entry->id]=
                           [
                                'label' => $entry->title
                            ] ;
                 }
            $arrPerm = array(
                'permissionName' => [
                    'label' => "Wave Member access",
                    'nested' => $entryPerms
                ],
            );
                    $event->permissions['Member restricted access'  ]  =
                        $arrPerm ;
                }
            );