Apply default filter using AccessControlFilter

[bandtank]

I'm trying to hide meetings from the list view when a boolean called Private is true. My understanding is I should implement an AccessControlFilter class in custom/Espo/Custom/Select/Meeting/AccessControlFilters, but it doesn't seem to be working. Here are my files:

custom/Espo/Custom/Classes/Select/Meeting/AccessControlFilters/HidePrivate.php:

<?php

namespace Espo\Custom\Classes\Select\Meeting\AccessControlFilters;

use Espp\Core\Select\AccessControl\Filter;
use Espo\ORM\Query\SelectBuilder;
use Espo\Entities\User;

class HidePrivate implements Filter
{
  public function __construct(
    private User $user,
  ) {}

  public function apply(SelectBuilder $queryBuilder): void {
    $GLOBALS["log"]->debug("HidePrivate",[]);​
  }
}
​

custom/Espo/Custom/Resources/metadata/selectDefs/Meeting.json:

{
    "accessControlFilterClassNameMap": {
        "hidePrivate": "Espo\\Custom\\Classes\\Select\\Meeting\\AccessControlFilters\\HidePrivate"
    }
}​ 

After rebuilding and refreshing, I was expecting to see "HidePrivate" in the log whenever a list of meetings is loaded in the list view. However, nothing is displayed. What am I doing wrong?

[rabii]

I thought that accessControlFilters should allow you to apply who can access data so it only triggers when the filter is selected e.g when you choose (my only) filter that filter list of record to only assigned to current user. this is how it should work AFAIK.

Have a look at the (my only) filter to understand more.

I found some additional info: check out how portalAccountOnly filter which applied to Portals

https://github.com/espocrm/espocrm/blob/f3bf7d93c1156ca802262eab7a9f9487336fbd78/application/Espo/Modules/Crm/Resources/metadata/selectDefs/Account.json#L9

https://github.com/espocrm/espocrm/blob/master/application/Espo/Modules/Crm/Classes/Select/Account/AccessControlFilters/PortalOnlyAccount.php

[bandtank]

Thanks for the response. Primary filters work as you describe, but I think access control filters are supposed to apply to every query. Examples of access control filters that behave the way I intend the private filter to behave are onlyOwn, onlyTeam, etc. Somehow the access control filter is supposed to be triggered with every query, but I am missing something. I reviewed the portal access control filters and they look similar to onlyOwn and onlyTeam, but I still can't figure out how to make my custom filter apply to every query.

My actual goal is to implement this.

[yuri]

FilterResolver defines what AccessControlFilter will be applied for a current user. It can be onlyOwn, onlyTeam, all, no.

There's a special 'mandatory' filter that will be additionally applied for all users. This is not the best solution if you customize an existing entity type, as other extension may utilize this 'mandatory' filter too. But there's no better alternative at the moment.

[bandtank]

Ok, thanks for the information. I will try that.

[bandtank]

A quick update:

{
    "accessControlFilterClassNameMap": {
        "mandatory": "Espo\\Custom\\Classes\\Select\\Meeting\\AccessControlFilters\\HidePrivate"
    }
}​

resulted in:

[2023-03-02 16:35:58] DEBUG: HidePrivate [] []

I am still working on the rest. This is a start, though.

[rabii]

i assume you just need to return a builder with your query and this should work.

[czcpf]

Do you have any additional info on this? I’m stuck here as well. Are we supposed to create custom portalOnlyAccount filters for filtering queries for portal users ? If so, do we also need to set the access control for the portal role to ‘account’ for the entity in question in order for these custom filters to be called?