How to Create a Limited EDIT Role without Pulling Out One's Hair

[caldwell]

We are wanting to create a Role in EspoCRM that can access all contacts, but can view only certain fields on a contact, and can only edit one field "widget."

Based on what I'm seeing so far, it seems like we have to add every (!) field to the granular permissions with a "no" for read or edit explicitly stated. This...is labor intensive. And if the schema gets updated in the future, we have to REMEMBER to go back and add anything we don't want viewed/edited under just that Role.

Surely, someone, is there another way to do this?

[victor]

Via the UI, this is the only way: https://docs.espocrm.com/administrat...level-security.

[caldwell]

Oof. Looks like Espo needs a "reverse ACL" option. "All no unless yes." This is very labor intensive for a customized Contact or Account record.

You say, "via the UI." Is there another way to set a role in a JSON file or something?

[a.slyzhko]

I see your point. We've faced the same problem many times in our company.

However, a reverse ACL approach wouldn't eliminate the manual work. You'd still need to explicitly allow read/edit access to every new field, since the system can't know which fields should be accessible to which roles.

If security is your main concern, though, you can actually implement this behavior with some custom coding.

Using a custom AdditionalBuilder, you can retrieve all fields from entityDefs and automatically populate app > acl > strictDefault > scopeFieldLevel for Account/Contact, setting read and edit to no by default.

This way, new fields would automatically be restricted, and you'd only need to explicitly grant access where necessary.

[victor]

Alternatively, you can use custom Layout Sets: https://docs.espocrm.com/administrat...-teams-portals for this purpose, or dynamic logic https://docs.espocrm.com/administration/dynamic-logic/ for displaying panels.