Complex problem with; CMP, custom tables combined with resources and permissions

Hi all,

Context
I've built and deployed several websites with modx (Evo and Revo) and now working on a bigger project. I'm developing a new website for my soccer club together with a friend of mine. I chose to develop it using MODx for flexibility. Now I'm stuck in a few concepts and do not know how to solve this without 'hacking' or ignoring great functionality of modx.

The idea (what to reach)
There should be teams which are linked to a specific season, which means teams will be archived and created every year. Those teams are related to matches and scores, which are inserted to the db periodically. Each team should have a page where soccer match reviews can be listed. Those reviews need to be edited by users, preferably from the front end(do not want to bother them with extra complexity of manager). Users can only edit reviews which are related to the team the users are related to.

Possible (failed) thoughts
Manage teams by a custom database table and a custom manager page. Manage reviews per team with MODx resources. There is a possibility over here to work with the 'Articles extra', however that could also add complexity. The reviews only need to possess some (auto)archiving functionality. Because there are around ~50 teams archived and created each year, I would like to create an automated script to create the teams and all connected instances.

The main problem over here are the teams and the resource management by the users. It could be implemented using a resource group for each team, where the users related to the team have to be part of the resource group. But then the automated script will create 50 resource groups every year, which will create an complex overview and an unmanagable environment for the other resource groups.Other thoughts are to create the reviews in the custom tables and manage them in the custom manager page. This requires an own implementation of a permission system and resource system. In this case I cannot benefit from the MODx advantages.What are your thoughts?

I hope you guys can help me out.

Cheers,
Huub

Is there anyone who can point me into the right direction? Like explain in three sentences the approach to get started?

I bought two books, studied advanced cases from the documentation, and do not need a fully detailed explanation. I'm just looking for the right approach.

Is there anybody who can think with me?

If it was for me, I would create custom-xpdo-objects for all of them:

Seasons, Teams, Seasonteams, Matches, Matchteams, Matchreviews, Reviewerteams ..... not sure, I forgot something

the Reviewers are modUsers or extended modUsers with a permission to create Matchreviews for their Reviewerteams and edit them.

You would need only one Resource which shows the currently filtered (by $_GET) Team and its Matchreviews (if I was understanding it correctly)
The permissions - system for this can be very simple.
You just need to check, if the user has the permission to edit or create Reviews and if the current Team is in the List of his Reviewerteams.

Backend - stuff: MIGXdb
Frontend - stuff: bloX, Formit, Formit2db

Bruno,

Thank you for taking time to reply! The solution you proposed sounds good, I will definitely try this. The only impediment I see is that reviews are not implemented as resources. So the benefits of resources cannot be utilized. I can live with that.

Of course other ideas are still welcome.

Thanks again!
Huub

We've built all the xpdo objects and relations. But i'm stuck managing the permissions. I've got two questions. You wrote:

You would need only one Resource which shows the currently filtered (by $_GET) Team and its Matchreviews (if I was understanding it correctly)
The permissions - system for this can be very simple.
You just need to check, if the user has the permission to edit or create Reviews and if the current Team is in the List of his Reviewerteams.

Permissions can be added to a menu item (in Actions > Update Menu) to deny access to migx url to manage a certain object. Question 1 If the url is known and a user has not the particular permission, can this page be viewed and used?

Another view:
Now I'm thinking that is about managing reviews from the front-end of the website (not in the manager). However some objects, like MatchScores, needs to be managed in the backend. This would be done preferably by using migx CRUD tables. Now the only solution I understand would be this one:

1. Create relation between the Match > Team > User
2. In MIGXdb-settings for Matches add this relation in the where field. Then only the matches of this team are shown.
3. For adding a new match, they can only choose from a combo, with teams in it they relate to.

However, there is no check at all if they match a team when an entry is added. So a smart developer could edit the values from the client side in the combo, and thereby add a match to another team.

Question 2: How to tackle this problem (in a secure way) with joins and select bindings?

I hope you/somebody can help me out. Thanks in advance!

Huub