3

I have the following use-case: employees usually have access to all cases in CiviCRM, but occasionally there can be a sensitive case that must only be visible to users with a higher permission level.

I looked at CiviCRM ACLs, but they do not seem to apply to Cases. I also found an old make-it-happen campaign but I don't think it happened.

I'm tempted to create an extension that adds a "confidentiality" custom field to cases, which would restrict access to the case itself, as well as to the case activities. I might not be able to alter the queries for listings (search cases, search activities), but if the subject itself is not confidential, it would be an acceptable compromise (and eventually we can introduce hooks in those listings, if necessary).

Has anyone ever done this? Any other solutions?

Improve this question
1

You can do it in reverse if regular users have only "access my cases" permission. If they need access to cases that aren't theirs they can be added as any role to that case which will let them see it. But it sounds like you want the default to be to allow at the start, so then at that point you're into some kind of coding anyway. But then rather than access hooks, your postprocess hook on a new case would add in all the other staff as a role unless the custom field says don't.

If you want to generalize it, the custom field could be a multiselect list of groups, with the default being an "all staff" group.

Improve this answer
1

I have an extension called CiviCase ACL which works similar to Activity ACL, but need to rewrite to support it for latest version of Civi. It does what it needs that is CRUD for specific user role based on case type with combination of Activity ACL to restrict activities. It does need a few hours of rewrite.

I did ask for adding a hook to alter(selectwhereclause) query for filtering the case on case dashboard but was told either to replace the whole dashboard or rewrite the core code to use the API instead of query. Rewriting using the API is a huge work and I don't have much time since there is much going on in those queries and I doubt API3 or API4 will support such complex join queries and also don't want to integrate results by doing multiple API calls. So I may rewrite the dashboard or do some hack to filter the case.

Improve this answer
0

I have used the related permissions module for that. you can use the relationship client - case manager to give access to the contact and with this also to the cases.

Improve this answer
  • I am missing something here, but it sounds like what I'm looking for. Basically I want to give permissions to view cases based on role assignment. Is that what you are doing? What's the "related permissions module" you are referring to? – G H Jul 1 '20 at 16:27
  • The Module is [civicrm.org/extensions/relationship-permissions-acls] but my answer might not match your entire needs. It might work if the contact already exists. If the contact first has to be added, and I guess, while adding a case, it is as first step necessary to add a contact, then you are not permissioned to see the contact. For that i use a line of code: adding a contact set a custom relationship i have called "contact owner", and with this relationship its allowed to see and edit the given contact (with the related permissions module). – lbl Jul 3 '20 at 5:39
  • in addition, if you go that way take a look at the issue civicrm.stackexchange.com/questions/35848 – lbl Jul 3 '20 at 5:50
  • Ha! Actually noticed that issue on WP and it was driving me crazy. The test user couldn't see any contacts, but could see the cases, and then error-ed out. Took a few minutes for my brain to catch up. Thanks for the heads up! – G H Jul 13 '20 at 18:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.