Is this topic in the wrong forum? Or was the original question about how to do this in Revo? If this topic is for Revo...
Once you have access permissions in place in Revo, the API returns secure data, like Resources, based on the user session, which contains their permissions. IOW, if I want to get all of the top level Resources the current user has permission to view (as determined by the access policies that apply to the user), I simply write in the snippet:
<?php
$objectCollection = $modx->getCollection('modResource', array('parent' => 0));
?>
and when executed, the resulting collection of objects will be based on the user who’s session is active. Done. You just have to be conscious of not caching things inappropriately when you are presenting collections of potentially protected data like this.
This means, in order to bypass the built in security policy-checking in the MODx API, you would have to cheat a little and bypass the object loading by using the lower-level PDO-based API, which is still part of MODx since it extends xPDO:
<?php
$query = $modx->newQuery('modResource', array('parent' => 0));
$rowCollection = array();
if ($query->prepare() && $query->stmt->execute()) {
$rowCollection = $query->stmt->fetchAll(PDO_FETCH_ASSOC);
}
?>
Building a query to determine a list like you are wanting is more difficult however in Revo, because the security is now policy based, not just secure or insecure if you are in a certain group. You need the API to determine security now, you can’t just query it with some extra JOINs like you can in 0.9.x, though we can craft queries to determine some basic things without getting down to the fine-grained policy attributes.
Perhaps if we discuss more precisely what you want to do, we can focus in on the best approach to get exactly what you want.
If this is not meant for Revo, just ignore this post.
MODX Staff