Permissions in Revo: Roles

I keep spinning my brain around and around with this, and I thought the forums might be a more productive place for a discussion on MODx User-groups, Roles, and Resource Groups.

Here’s my scenario:

* The site supports logins from various "companies", with each company having its own dedicated User Group.
* Each company has a dedicated folder of resources: the resources belong to a dedicated Resource Group for each company (so Company A can’t see Company B’s docs).
* Each company has one (or more) users designated as a "company admin" role, so that user can see some additional reports and use some additional tools.

The question is how to set up a page that is accessible by only each company’s "company admin"? The "company admin" belongs to the company User Group, but he has a higher authority due to his role.

So how should this be enforced? For simplicity, let’s say that each company has one special page with reports and tools on it that only the "company admin" should be allowed to access. Currently, that page belongs to the company’s dedicated Resource Group, so everyone in the company can see it, which is not desired. I could add element category access... but that seems overly complicated, and I’m not sure how it works... if I have a Snippet on the page that generates the special report, is it enough to require a role of "company admin" to view that element?

The only other way I can envision this is to have a special Resource Group for those special reports AND have a User Group of "company admins", so each company admin would belong to his company’s User Group, AND to the "Company Admins" user group... but that doesn’t work too well either because if your user’s User Group has access to ANY of the Resource Groups that a page belongs to, you’ll be able to see it (http://modxcms.com/forums/index.php/topic,64688.msg365950/topicseen.html). That would mean that the "company admin" from Company A would be able to see the report page for Company B.

Oiy... this is complicated. Any thoughts or enlightenment?

Thanks.

Here’s my take on it (not necessarily correct). Unless you put each company’s resources in a different context (and I wouldn’t recommend that), each company’s admin pages will have to be in a separate resource group (call it something like CompanyXadminPages). The other resources for that company would be in something like CompanyXregularPages.

As you suggested, each company will have a different user group. In a given company’s user group, a Resource Group Access ACL entry for that company’s admin pages resource group -- with a minimum role that the regular company users won’t have -- will protect those resources from everyone but that company’s admin user. The admin user will inherit the permissions of the regular users in that group, so he or she will see all the pages in both company resource groups. The regular users will see all but the admin pages.

If you need an admin Super User who can see everything, add that user to *every* user group with a role of admin Super User.

You might want to create a separate policy for the admin users ahead of time (based on the resource policy template) so you can add that in as you go.

Thanks Bob -- that does make sense. So having roles in this case eliminates the need to have 2 user groups for each company. It might be interesting if you could set the minimum required role on each resource, e.g. "Special Page" belongs to Resource Group A and requires a minimum role of "District Sub Manager" or something... but that’s making it more complicated than it already is.

Quote from: Everett at May 20, 2011, 09:49 AM

Thanks Bob -- that does make sense. So having roles in this case eliminates the need to have 2 user groups for each company. It might be interesting if you could set the minimum required role on each resource, e.g. "Special Page" belongs to Resource Group A and requires a minimum role of "District Sub Manager" or something... but that’s making it more complicated than it already is.

And it’s definitely complicated enough already.

Quote from: Everett at May 20, 2011, 09:49 AM

Thanks Bob -- that does make sense. So having roles in this case eliminates the need to have 2 user groups for each company. It might be interesting if you could set the minimum required role on each resource, e.g. "Special Page" belongs to Resource Group A and requires a minimum role of "District Sub Manager" or something... but that’s making it more complicated than it already is.

You’re in charge, and in the end it’s just combining the right resource groups and roles per user group. See example.