CiviCRM Entity and ACL Permissions

Question

We are a federated political organisation migrating to CiviCRM 4.6. I have integrated CiviCRM with Drupal views and civicrm_entity so we can create customised search pages for local organisers.

I'm finding civicrm_entity and various fuzion extensions to be excellent help, but setting up permissions across a large grassroots organisation is still complex. We are currently managing this with a combo of permissioned relationships and auto-generated smart groups.

Question:

Currently, to view entity via civicrm_entity (at e.g. civicrm-contact/[id]), a user seems to require the 'view all contacts' Drupal permission.

Is there an easy(ish) way to make civicrm_entity respect CiviCRM ACLs? Or at least check that the logged in user has permissioned relationship with that contact?

thanks, L

Answer 1

I wish i would have seen this question earlier, I can certainly help you out.

checkout civicrm_entity.api.php in the civicrm_entity module

I don't believe the controller is checking the ACL's when loading an entity. We may be able to add 'check_permissions' => True to the call there in civcirm_entity_controller.inc CivicrmEntityController::loadEntites... food for thought, make a feature request in the civicrm_entity queue if you still need this.

Alternatively

There is a hook, hook_civicrm_entity_supported_info() that you can implement and add entities to be exposed by the module or alter settings for the currently exposed entities. See the api information for full details.

Here you can alter what permissions are necessary to view/add/edit/delete entities via the CiviCRM Entity Drupal based forms or even set a custom callback.

function MYMODULE_civicrm_entity_supported_info(&$civicrm_entity_info) {
      $civicrm_entity_info['civicrm_contact'] = array(
        'permissions' => array(
          'access_callback' => 'MYMODULE_some_custom_callback_name'
        ),
      );
    }

This will tell CiviCRM Entity to use your custom callback instead of 'user_access'

Your callback will look something like this:

    function MYMODULE_some_custom_callback_name($op, $entity_type, $entity, $account) {
      if (is_null($account)) {
        global $user;
        $account = $user;
      }
       if($entity_type == 'civicrm_contact' && $op == 'view') {
         // fetch contact_id for user via a uf_match api get call
         // do your custom permission check
         $rules = getAllByContact($contact_id); //maybe get the acl rules for a contact
        // determine whether the contact can view with some code here
        // then assuming the contact can view the contact
        $contact_can_view = TRUE;
        // or if not
        $contact_can_view = FALSE;
         return $contact_can_view; 
       }
    }

see some useful information about getting ACL rules for a contact here: https://wiki.civicrm.org/confluence/display/CRM/Access+Control+List+Permissioning+Specification