List of tasks created by user

[dmytro_s]

Hello. We have a problem with the permissions for non-admin users. For example, most users have permission to read/write Tasks as "Team". So if a task has this user as "Assigned users" and/or his team the user can see this task in the list.
But sometimes user creates new tasks for other users or teams. And in this case, he cannot find this task in CRM. First, he even cannot open the task via a direct link because of error 403. OK, I found a solution and added the file custom/Espo/Custom/Acl/Task.php with the next code:

<?php
namespace Espo\Custom\Acl;

use \Espo\Entities\User;
use \Espo\ORM\Entity;

class Task extends \Espo\Core\Acl\Base
{
public function checkEntityRead(User $user, Entity $entity, $data)
{
if ($this->checkEntity($user, $entity, $data, 'read')) {
return true;
}

if ($user->id === $entity->get('createdById')) {
return true;
}

return false;
}

public function checkEntityEdit(User $user, Entity $entity, $data)
{
if ($this->checkEntity($user, $entity, $data, 'edit')) {
return true;
}

if ($user->id === $entity->get('createdById')) {
return true;
}

return false;
}

public function checkIsOwner(User $user, Entity $entity)
{
if ($entity->hasAttribute('assignedUserId')) {
if ($entity->has('assignedUserId')) {
if ($user->id === $entity->get('assignedUserId')) {
return true;
}
}
}
if ($entity->hasAttribute('createdById')) {
if ($entity->has('createdById')) {
if ($user->id === $entity->get('createdById')) {
return true;
}
}
}

if ($entity->hasAttribute('assignedUsersIds') && $entity->hasRelation('assignedUsers')) {
if ($entity->hasLinkMultipleId('assignedUsers', $user->id)) {
return true;
}
}

return false;
}

}
​

OK, now the user can open the task. But he still does not see it on the list. I added a new filter custom/Espo/Custom/Select/Task/PrimaryFilters/tasks_created_by_me.php with the next code:

<?php
namespace Espo\Custom\Select\Task\PrimaryFilters;
use Espo\Core\Select\Primary\Filter;
use Espo\ORM\Query\SelectBuilder;
use Espo\ORM\Query\Part\Condition as Cond;
class task_created_by_me implements Filter
{
    public function apply(SelectBuilder $queryBuilder): void
    {
        $queryBuilder->where(
            Cond::in(
                Cond::column('createdById'),
                [$user->id]
            )
        );
    }
}

and it works for admin users, who can read all the tasks, but other users don't see tasks created by themselves if they haven't them as assigned users or their teams.

Could you please suggest how we can resolve this issue? Thanks.

[murray99]

Assuming that you have set up your meta data as per

https://docs.espocrm.com/development/metadata/select-defs/#primaryfilterclassnamemap

Shouldn't your task_created_by_me have a queryBuilder something like

->leftJoin( 'EntityTeam','et',['et.entityType'=>'task','et.entityId:'=>'id','et.deleted'=>false])
->leftJoin('TeamUser','tu',['tu.teamUserId:'=>'et.teamId','tu.deleted'=>false])
->leftJoin('User','u',['u.id:'=>'tu.userId','u.deleted'=>false])
->where(Cond::or(
Expr::equal(Expr::column('createdById'),$user->getid()),
Expr::equal(Expr::column('assignedUserId'),$user->getid()),
Expr::isNotNull(Expr::column('u.id')
)
)

basically left join the team user stuff and set an or condition that it returns a user id