I am attempting to create a Drupal view/block to embed in a panel, so a user can see their current membership details when they log in (beginning date/end date/type) etc. I have this overriding the default user page. That's working.
What is not working great - is creating an "Actions" field in the view that contains links to cancel, update the card, or change the amount of the recurring series.
I ripped the URL's from the receipt template:
i.e. civicrm/contribute/unsubscribe?reset=1&coid=XXXXX
And then used a view to find the recurring contribution for the membership, and then used a 'views field view' (a child-view) to get the contribution ID, which actually creates these links.
So, I have arrived at a working link such as the above: civicrm/contribute/unsubscribe?reset=1&coid=XXXXX when I click it for myself (admin user) it works, but when I log in as a test user it will say "You do not have permission to cancel this recurring contribution".
I've gone through the checklist of permissions - enabled self-service via the iATS admin tool, as well as given the user permission to make online contributions. I've also updated the code suggested here: Only logged in users can change billing and recurring amount
Over on this exchange (Donor access to edit recurring donations) it seems like a contact checksum must also be embedded. Does this mean that my project is out of luck, that we can only generate these links from the context of civi? In views we can generate the contact hash, but that seems dangerous/not the same thing.
I am assuming the civi dashboard for users is kind of ugly and has some permissions limitations, so I was really trying to use views/drupal to generate this functionality.
Please let me know, happy to share my work! The workflow we want is - users log in, see their memberships, can do actions upon those memberships (seems obvious, right?)
I also found this - https://github.com/MegaphoneJon/com.megaphonetech.checksums but making the link from views is currently beyond my capacity.
update: It seems like the "Edit Contributions" permissions would allow them to do it. Also seems dangerous. I messsed around and put in different contact/contribution ids and tried to load various civi pages, it seemed to throw access denied..so hmm?
