2

Complicated question regarding asset sharing for a client proposal.

The website to be built will contain reports uploaded by a super-admin. These reports will be PDFs, tagged by year and be about specific users. The users that the reports relate to will be registered members of the site, and will be able to view reports regarding themselves.

Users will be able to log in to their members area of the website (front-end), and send requests to view other users' reports, and approve requests from other users to view their own reports.

Example

  • User1 has a login to the site, and has access to user_1_report.pdf
  • User2 logs in and sends a request to User1 to view user_1_report.pdf
  • User1 receives a notification in their members area and can click Approve / Deny
  • User2 gains access to the user_1_report.pdf as a download link in their members area.

Can anyone suggest how this might be implemented? I'm assuming that it needs to be done with a custom built plugin but I'd love to know if it's possible without.

If it is plugin-only and there are any Craft plugin developers available, let me know as there is a budget available for someone to build that area of the site if necessary.

4
  • i think this would be best with a plugin... will a super admin always be the only one that can upload the reports? when a user approves another people to see the report do they approve all reports or individual reports? Oct 28 '14 at 13:18
  • The super admin would be the only person who uploads reports, then gives access to the user it relates to. When a user approves a request to view the file, they would approve a specific report to be viewable by one user. Oct 28 '14 at 13:19
  • 1
    If approval of the request is enough, and you dont need to approve individual reports, a simple "friendship" plugin would be enough. I could build that for you. let me know, lukemh at gmail.com Oct 28 '14 at 13:20
  • You could make each report an entry and have a owner (the user who can give access to that report) and then have a user relationship field that list all users who have access. The plugin would simply email the person who owns the report and they could click a button to allow or deny the person which will just add the requestors user account to the relationship field. Oct 28 '14 at 13:23
2

As you've noted, this is a complex and would require a proper discovery and planning phase to sort out all the details. Here are a few thoughts on each stage of the process that you discussed. It looks like Luke has approached the problem in a similar way in the comments above.

User1 has a login to the site, and has access to user_1_report.pdf

This could potentially be handled by a Craft Entries or Users Relations field. You could let somebody relate a Report to the specific User who should be able to see it, or allow a User Profile to be related to several differnet Reports. In whichever case, you could limit who has visibility to the reports in the front-end by only displaying Reports to Users who have the right relationship to them.

User2 logs in and sends a request to User1 to view user_1_report.pdf

This will need to be handled with a plugin. I would approach the problem in two steps. The first part of the problem is an email notification problem, and the second part is an action that will required changing the relationship or permissions of who has access to something. Depending on how secure you need things to be, there may also be a validation component to ensure that only a User that has received an invite is able to accept that invite.

There are likely some Email plugins that could help get you started with the Email notification part of this. We have built similar authentication workflows using Sprout Email. For the particular approval action that you need, it's likely you'll need to approach that as a separate custom plugin that handles the specific action you need.

User1 receives a notification in their members area and can click Approve / Deny

This is mostly addressed in my previous comment. When you trigger the notification email, you can make sure that the notification email includes a link to help the user Approve/Deny the request. In my discussion above, those Approve or Deny actions would probably be links to controller actions that handle the behavior you need, or to a page on your site that then allows the user to trigger the right action.

User2 gains access to the user_1_report.pdf as a download link in their members area.

Once the approval workflow is sorted out, this will likely just be handled in the same way as the first scenario – via a Relations field or some permission and the standard Twig code needed to output that data. One option could be to have an "Approved Users" field on a Report Entry, and your custom action would trigger adding the invited user as a Relation to the Report that they were invited to.

1
  • Hi Ben, thanks for your detailed answer above. The project in question isn't happening anymore, but it's really handy to have this as a reference of something that is possible and how to achieve it in future. Thanks! Aug 23 '15 at 13:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.