How fine-grained are permissions and sub-permissions in MODx Revo?

I have done quite a lot with MODx but not much with roles, permissions etc. as yet. I need to know if the following scenario is doable in MODx:

• Site has a number of Manager users.
• Each Manager user has an associated group of Web users which he can create and manage.
• Manager users cannot manage, or even see, the Web users belonging to other Manager users’ groups.

Thanks.

I don’t believe there’s any way (yet) to control which users a Manager user can "see" in the Manager. I think it could be done with a plugin, but it would be fairly challenging to create.

This policy-based user management is not yet supported in Revolution. Feel free to file it as a feature request, but I can assure you that’s in the roadmap.

Quote from: BobRay at Oct 07, 2010, 11:10 PM

I don’t believe there’s any way (yet) to control which users a Manager user can "see" in the Manager. I think it could be done with a plugin, but it would be fairly challenging to create.

They don’t absolutely have to be hidden from view, but it is essential that the manager only be able to modify users in his own group. Is that possible?

Quote from: kenquad at Oct 08, 2010, 11:00 AM

Quote from: BobRay at Oct 07, 2010, 11:10 PM

I don’t believe there’s any way (yet) to control which users a Manager user can "see" in the Manager. I think it could be done with a plugin, but it would be fairly challenging to create.

They don’t absolutely have to be hidden from view, but it is essential that the manager only be able to modify users in his own group. Is that possible?

Not at the moment; as splittingred mentioned, there are no ACLs for attaching User Management policies (with permissions for User Management actions) to specific User Groups, but this will be a future core feature. Currently, it’s all or nothing; you can manage all users or none of them.

Ooh, this isn’t good. I am quoting a project that needs something like this and I really want to use MODx! :’(

Let’s approach from another angle: Is there a front-end web user management snippet which would allow me to show a different set of users to each manager on the frontend?

Quote from: kenquad at Oct 08, 2010, 12:04 PM

Let’s approach from another angle: Is there a front-end web user management snippet which would allow me to show a different set of users to each manager on the frontend?

Absolutely could be written using the existing API’s, but I do not think there is a pre-made solution for this yet, if that’s what you mean.

Quote from: OpenGeek at Oct 08, 2010, 12:09 PM

Absolutely could be written using the existing API’s, but I do not think there is a pre-made solution for this yet, if that’s what you mean.

Okay, if I wanted to do this, can you point me to a good starting place as far as docs, etc? I know there’s the API reference but I’m thinking of something a little more readable than that to get started

I have in the past done some snippet development that involved a few hooks to the MODx core.

Quote from: kenquad at Oct 08, 2010, 02:34 PM

Quote from: OpenGeek at Oct 08, 2010, 12:09 PM

Absolutely could be written using the existing API’s, but I do not think there is a pre-made solution for this yet, if that’s what you mean.

Okay, if I wanted to do this, can you point me to a good starting place as far as docs, etc? I know there’s the API reference but I’m thinking of something a little more readable than that to get started

I have in the past done some snippet development that involved a few hooks to the MODx core.

It will take you a little while to get a grip on xPDO, but once you have it, it makes stuff like what you’re trying to do really easy.

http://bobsguides.com/revolution-objects.html

Quote from: BobRay at Oct 08, 2010, 10:48 PM

http://bobsguides.com/revolution-objects.html

I referred to that excellent page during my last project. You have done a real service by making this information available. Thanks!