Extending permission schema for Portal Roles

[TMAG_mbohlender]

Hello community,

I am on the hunt for a solution to build a sales channel partner portal. We are using EspoCRM very successfully and I would really like to use EspoCRM's portal functions for this. However I am struggling with the most important requirement coming from our mixed mode of direct and indirect sales:

We have two types of accounts on the sales side: customers and partners. For direct sales, customers are directly assigned to us and the portal functions would work perfectly fine as the permission type "account" for portal users is exactly doing what we need. The logged in user sees all permitted entities related to the account (=customer) he / she is working for. Perfect!

For accounts of type PARTNER this also works fine as they technically do NOT differ from the direct customers. Portal users for contacts of a partner see all entities related to the account.

However: Customers in the indirect sales (= the channel) are related using a custom field (acountPartner) to the account of the partner. As such, the permission model cannot work on these accounts for the contacts of the partner as they are NOT directly related to each other. Assigning the contact persons of the partner to each related account is not an option for us. I know this would make it possible to use the "normale" permission type "account" ... and this is, where my problems is.

Question: is it possible at all to have a custom permission type in the portal roles that makes use of another relation than account or contact. And in this special case, it would be an indirect relation:

Portal User = Contact of Partner --> Permission "PARTNER" --> access to all entities related to the account of the contact by the custom field "accountPArtner"

This means that the portal user has access to the entities of ACCOUNT and those of "customers of ACCOUNT". Sales Reps of our partners can then have an overview of their customers in touch with us and their actitivies

Any help much appreciated

Regards
Michael

[yuri]

Hi Michael,

Having a custom role level (on top of the existing all, account, contact, own, no) is not trivial. I think there's no future-proof way to extend it.

It's worth to consider re-purposning the 'account' level while a custom access control logic will take into account the account type (of the Account related to the Portal User). You will need to create custom portal access checkers for every entity type you need, and it would be quite simple to do. You will also need to create custom access control filters. I suggest building the query depending on the current user (portal user).