We don't really have the proper groundwork in place at the moment to do things like this. I've been planning to rebuild permissions from that ground up for some time, but it's a fair amount of work.
Initially I was just thinking we'd stick with the current roles (instead of groups). We could possibly add groups in the future, but it's important to remember that the target audience for ITFlow is small MSPs and we want to keep things (especially something as important as the permissions system) simple. Yes, that may mean we give up some granularity, but does a small MSP really need to control that a specific tech shouldn't be able to access a specific module for a specific client?
We need to properly define the roles in the database alongside their current permissions (roughly this):
Table: user_roles
- user_role_id
- user_role_name
- user_role_description
- user_role_admin_settings_access
- user_role_clientmgmt_access
- user_role_ticketing_access
- user_role_accounting_access
- user_role_billing_access
- user_role_password_access
- user_role_etc_….
Each access entry (except admin) would have permissions of either:
- 0 - No access
- 1 - Read
- 2 - Write (Read/Write)
- 3 - Full (Read/Write/Delete)
So a technician might have:
- user_role_id = 3
- user_role_name = Technician
- user_role_description = Built-in role for technicians
- user_role_admin_settings_access = 0 (none)
- user_role_clientmgmt_access = 2 (read/write)
Once this is in place we'd need to rewrite the existing check to be more specific for every page and function. Rather than just checking if someone is a technician, we'd check if the technician role actually has the access level required.
For example (just off the top of my head): Editing a client overview page, we'd check like validateAccess('clientmgmt', 'write');
check_login.php
// Get access levels from DB
$sql = mysqli_query($mysqli, "SELECT * FROM user_roles WHERE user_role_id = $session_user_role_id")
// Set each module access in user session
$session_user_role_clientmgmt_access = $sql['user_role_clientmgmt_access']
--
functions.php
function validateAccess($module, $checkLevel) {
// Map levels
if ($checkLevel = 'read') {
$checkLevelInt = 1
} elseif ($checkLevel = 'write') {
$checkLevelInt = 2
} elseif ($checkLevel = 'full') {
$checkLevelInt = 3
} else {
return false;
}
// Check access level (if the role in the session (e.g. 2 for a technician is equal or greater than the checkLevel (e.g. also 2 for this) requested, grant access)
if ($module = 'clientmgmt') {
if ($session_user_role_clientmgmt_access >= $checkLevel) {
return true;
}
return false; // default return
}
}
--
This would then need a GUI written to allow the roles to be editable (with the ability to create additional roles, too).
Once all of this is in place, then we should look at restricting individual access to clients (based on tags, etc). We had this previously but removed it. Again, I don't think we should go much further (e.g. defining certain pages per client that roles can/can't access) as it creates unnecessary complexity.
