SecuritySuite settings - inherit from parent

[kir]

hi

i'm trying to set SecuritySuite options to target next
I want to user can see only some accounts and all related information to them - Contacts, activites and history (Calls, Notes..), Opportunities, few more custom modules related to accounts.

mean one of the user login to sugar as freelancer and work with some accounts. Managers of these accounts continue work with the same accounts as normal

what settings i have to use for SecuritySuite to achieve this?

Now i have to set all records in all related modules to freelancer group. And this is not acceptable.

thanks in advance!

Sugar 6.3.2 CE
SecuritySuite premium

[eggsurplus]

For an existing system with data already in place you may need to do some data work to set it all up if you want to avoid manually setting the groups. The key table is securitygroups_records. Check out an existing row and replicate how the data is being stored in there.

Going forward, once you have inheritance set to "Inherit from Parent" the appropriate groups will be associated to any records created that are related to that parent.

[kir]

thanks, Jason!

Does it mean that i will have to do assigning of all tree of records related to account every time i assign new account to the freelancer?
And how it will work if i want to un-assign account with all related? - again manually unset group for all related records?

Thanks in advance!

[eggsurplus]

Are you using groups in place of users? This generally doesn't happen very often for normal group/team usage. Not sure why you would need to be assigning groups and unassigning groups on a regular basis. For unique cases like these some have created logic hooks to help automated some of the unassignment process.

[kir]

imagine small distributor company (metal cutting tools)
manager work on sale process - personal role is Manager (with proper access rights). One manager works with some Accounts records (100 accounts per manager). 6 managers.
internal engeneers have access to all accounts information - EngRole. they consult managers and help to sale (create tech quotes).
now need to give access to some accounts with all related information for external engeneer.

so i set group role for outsource engeneer - can see only Accounts records with assigned group (it is like personal group specially for him). I want him to be able to see all related activities and log calls, tasks, meetings, create some records in custom modules related to assigned accounts records.

is there better way to achieve this?

[eggsurplus]

Got it. That makes sense. Having a cascade add/remove option would be an excellent feature request here: https://www.sugaroutfitters.com/support/securitysuite

For now, I'd suggest adding an after_relationship_add and after_relationship_delete hook to do what you want.

[kir]

Got it. That makes sense. Having a cascade add/remove option would be an excellent feature request here: https://www.sugaroutfitters.com/support/securitysuite

For now, I'd suggest adding an after_relationship_add and after_relationship_delete hook to do what you want.

request done!

can you give little bit more information about hooks to create
i'm not so familiar with internals of securitySuite.

thanks in advanace

p.s. SecuritySuite premium for 6.3.2 CE

[eggsurplus]

You could do it much like adding a record to a relationship with any bean. In the hook you would get all related records for the account (cases, contacts, etc) for as deep down as you want to go. For each record add or remove the appropriate group based on the group that was added/removed from the account. I don't have a code snippet on me but will look around when I can grab a minute. Can't guarantee when that will be.

[kir]

am i got it right:
mass insert/delete records to/from table securitygroups_records on relationship add/delete event between accounts and given group from securitygroups table?
will it be enough to achieve subj ?

[eggsurplus]

Yes, but you can also do it the normal SugarCRM way using the bean relationships. It's up to you. With the bean relationships you would iterate through each related record and add the group to that record. For example, for a contact related to an account it would be something like:

 //psuedo code
while($relatedcontacts as $contact) {
   $contact->load('securitygroups');
   $contact->add($securitygroup_id);
}