Team visibility and sub-team

[nicolar]

Hi,
I'm going to ask if it is possible to implement this type of team and sub team tree:

agent_1 (team leader with team visibility)
|----agent_2 (see only own records)
|----agent_3 (see only own records)
|----agent_4 (Sub-team leader only with his team visibility)
|------agent_5 (see only own records)
|------agent_6 (see only own records)

Agent_1 have to see all others agents, Agent_4 have to see only 5 and 6.
Thank you so much for answers.

P.S. I can develop a specific custom team query if it is possible to extend somewhere.

[peterberlin]

Hello,
Under teams are not possible in ESPO.
My idea is:
You could form two teams.
1,2,3 and 4,5,6 . Members only see your records . The rights of the team leaders are extended by further roles.

Peter

https://github.com/espocrm/documentation/blob/master/docs/administration/roles-management.md

https://www.espocrm.com/video/security-roles/

[nicolar]

This is what I've done at the moment, two different teams, where agent 1 and 4 are at the same level but with a team visibilty role, instead agents 2,3,5,6 are owners.
I'm searching the file where override visibility and add this functionality by myself.

[peterberlin]

"I'm searching the file where override visibility and add this functionality by myself."
I don't understand that sentence. What is the purpose?

[nicolar]

I'm a web developer, I can develop a customization to the team visibility query by myself, but I don't know where exately, in the code, do this, so I'm asking the community if someone know where I can override

[telecastg]

Could you explain what do you mean by "overriding team visibility" ?, do you mean override how permissions are checked for a Team ?

If you want to override how permissions are checked in Espo, the script that defines that functionality is application\Espo\Core\AclManager.php but I would strongly advise against modifying any core files since all changes will be lost during an upgrade, so if you do, you will have to manually recheck those scripts every time that you update Espo.

Espo permissions are actually defined as a JSON object stored in the "data" field of the Role entity and Roles are linked to Teams in a many-to-many relationship, so if you want a Team (Parent Team) to include another Team's "rights" (Sub Team) all you need to do is associate the Parent Team with it's own role(s) plus with the Sub Team's roles, which is what peterberlin solution offers.


Perhaps the above diagram can help clarifying the relationships.

However, since you are willing to do some custom coding , a better option in my opinion, to avoid having to manually assign roles to Parent Teams and keeping to keep track of those changes, is to modify the Team entity to create the Parent Team - Sub Team relationship that you describe, and a hook that will add the Sub Team roles to the Parent Team every time that a Sub Team is created or updated.

In the illustration below, the Team "Maintenance" is a Sub-Team of "Management". "Management" by itself doesn't have any roles associated with it, but since it is the parent of "Maintenance", all the roles linked to "Maintenance" are also linked to "Management" and therefore all the permissions granted to "Maintenance" are also granted to "Management"



To accomplish this, you need to create the following scripts:

custom\Espo\Custom\Resources\metadata\entityDefs\T eam.json

{
    "fields": {
        "teamParent": {
            "type": "link"
        },
        "subTeams": {
            "type": "linkMultiple",
            "layoutDetailDisabled": true,
            "layoutMassUpdateDisabled": true,
            "noLoad": true,
            "importDisabled": true,
            "isCustom": true
        }
    },
    "links": {
        "teamParent": {
            "type": "belongsTo",
            "foreign": "subTeams",
            "entity": "Team",
            "audited": false,
            "isCustom": true
        },
        "subTeams": {
            "type": "hasMany",
            "foreign": "teamParent",
            "entity": "Team",
            "audited": false,
            "isCustom": true
        }
    }
}

custom\Espo\Custom\Resources\layouts\Team\detail.j son

[
    {
        "rows": [
            [
                {"name": "name"},
                {"name": "teamParent"}
            ],
            [
                {"name": "roles"},
                {"name": "positionList"}
            ]
        ]
    }
]

custom\Espo\Custom\Resources\layouts\Team\relation ships.json

[
    {
        "name": "users"
    },
    {   "name": "subTeams"}
]

custom\Espo\Custom\Hooks\Team\TeamHooks.php

<?php
namespace Espo\Custom\Hooks\Team;

use Espo\ORM\Entity;

class TeamHooks extends \Espo\Core\Hooks\Base
{

    public function afterSave(Entity $entity, array $options=array())
    {

        // check if the created or updated Team belongs to a Parent Team
        if($entity->get("teamParentId")) {
            // get the roles linked to the new or updated Team
            $targetRoles = $this->getEntityManager()->getRepository('Team')->findRelated($entity,'roles');
            // get the parent team object
            $parentTeamObject = $this->getEntityManager()->getRepository('Team')->where(['id'=>$entity->get("teamParentId")])->findOne();  
            // link the target Team roles to the Parent Team
            foreach($targetRoles as $targetRole) {
                $this->getEntityManager()->getRepository('Team')->relate($parentTeamObject, 'roles', $targetRole->get('id'));
            }                        
        }
    }

}

custom\Espo\Custom\Resources\i18n\en_US\Team.json

{
    "fields": {
        "parentTeam": "Parent Team",
        "teamParent": "Team Parent",
        "subTeams": "Sub-Teams"
    },
    "links": {
        "teamParent": "Team Parent",
        "subTeams": "Sub-Teams"
    }
}

Afterwards, go to Administration, clear cache and rebuild. This implementation will be "upgrade safe" since everything is contained in the "Custom" namespace which is not affected by upgrades.

[nicolar]

Dear telecastg,
thank you for your suggestions. I will try to implement your code to auto update teams and roles. Thank you so much!

[telecastg]

My pleasure nicolar .

Thinking that your idea of having nested levels of authorization would also be very useful for other participants, that might not have the skill or desire to code, I also packaged the scripts as a free extension plug in that can be installed using the Administration GUI.

Here's the link in case anyone else is interested.

https://github.com/telecastg/nested-teams-for-espocrm

[item]

Wonderfull telecastg... thanks

[esforim]

And installed it once I read this.

[Hacko]

I have installed the extension, but I don't see the extra fields. But if i move the layouts to the custom folder it works. Is that normal?

[telecastg]

Yes it is. When I wrote that extension I did not specify a level of hierarchy for the extension, so Espo is overriding the layouts with the core layouts. Moving them to the "Custom" namespace puts them in the highest hierarchy so now they override any other equivalent core layout.

I corrected the extension so you can load the new version (1.0.1) or, if you prefer, moving the layouts to the Custom namespace is a good solution.

[Hacko]

Thank you, i moved it to custom folder. But I see now difference between your packages, except the manifest file and the module file.

[jakov]

Dear telecastg,
thank your your help and solutions. I installed that extension on nevest version and can not see layouts like yours. Shoul I try to move it to the Custom namaspace?