Added user admin permissions

assets/organisations/js/widgets/organisations.js

@@ -189,6 +189,13 @@ function bindOrganisationButtons(el, options) {
             var options = {
                 ajax: {
                     url: site.uri.public + '/api/organisations',
+                    data: function (params) {
+                        return {
+                            filters: {
+                                info : params.term
+                            }
+                        };
+                    },
                     processResults: function (data) {
                         var items = data.rows.filter((i) =>  i.slug != organisation_slug);
                         return {

locale/en_US/messages.php

@@ -51,7 +51,7 @@ return [
         'DELETE_YES'                     => 'Yes, delete organisation',
         'DELETION_SUCCESSFUL'            => 'Successfully deleted organisation <strong>{{name}}</strong>',
 
-        'MEMBER_COUNT'                   => '# Members <sub>(excl admins)</sub>',
+        'MEMBER_COUNT'                   => '# Members',
         'ADMIN_COUNT'                    => '# Admins',
 
         'SELF'                           => [

src/Database/Migrations/v1_0_0/OrganisationApprovalsTable.php

@@ -7,7 +7,7 @@
  * @license   https://git.avsdev.uk/avsdev/sprinkle-organisations/blob/master/LICENSE.md (LGPL-3.0 License)
  */
 
-namespace UserFrosting\Sprinkle\Organisations\Database\Migrations\v010;
+namespace UserFrosting\Sprinkle\Organisations\Database\Migrations\v1_0_0;
 
 use Illuminate\Database\Schema\Blueprint;
 use UserFrosting\Sprinkle\Core\Database\Migration;
@@ -25,7 +25,7 @@ class OrganisationApprovalsTable extends Migration
      * {@inheritdoc}
      */
     public static $dependencies = [
-        '\UserFrosting\Sprinkle\Account\Database\Migrations\v400\UsersTable',
+        '\UserFrosting\Sprinkle\Account\Database\Migrations\v430\UpdateUsersTable',
     ];
 
     /**

src/Database/Migrations/v1_0_0/OrganisationMembersTable.php

@@ -7,7 +7,7 @@
  * @license   https://git.avsdev.uk/avsdev/sprinkle-organisations/blob/master/LICENSE.md (LGPL-3.0 License)
  */
 
-namespace UserFrosting\Sprinkle\Organisations\Database\Migrations\v010;
+namespace UserFrosting\Sprinkle\Organisations\Database\Migrations\v1_0_0;
 
 use Illuminate\Database\Schema\Blueprint;
 use UserFrosting\Sprinkle\Organisations\Database\Models\Organisation;
@@ -29,8 +29,8 @@ class OrganisationMembersTable extends Migration
      * {@inheritdoc}
      */
     public static $dependencies = [
-        '\UserFrosting\Sprinkle\Account\Database\Migrations\v400\UsersTable',
+        '\UserFrosting\Sprinkle\Account\Database\Migrations\v430\UpdateUsersTable',
-        '\UserFrosting\Sprinkle\Organisations\Database\Migrations\v010\OrganisationsTable',
+        '\UserFrosting\Sprinkle\Organisations\Database\Migrations\v1_0_0\OrganisationsTable',
     ];
 
     /**

src/Database/Migrations/v1_0_0/OrganisationMembershipApprovalsTable.php

@@ -7,7 +7,7 @@
  * @license   https://git.avsdev.uk/avsdev/sprinkle-organisations/blob/master/LICENSE.md (LGPL-3.0 License)
  */
 
-namespace UserFrosting\Sprinkle\Organisations\Database\Migrations\v010;
+namespace UserFrosting\Sprinkle\Organisations\Database\Migrations\v1_0_0;
 
 use Illuminate\Database\Schema\Blueprint;
 use UserFrosting\Sprinkle\Core\Database\Migration;
@@ -25,7 +25,7 @@ class OrganisationMembershipApprovalsTable extends Migration
      * {@inheritdoc}
      */
     public static $dependencies = [
-        '\UserFrosting\Sprinkle\Account\Database\Migrations\v400\UsersTable',
+        '\UserFrosting\Sprinkle\Account\Database\Migrations\v430\UpdateUsersTable',
     ];
 
     /**

src/Database/Migrations/v1_0_0/OrganisationsTable.php

@@ -7,7 +7,7 @@
  * @license   https://git.avsdev.uk/avsdev/sprinkle-organisations/blob/master/LICENSE.md (LGPL-3.0 License)
  */
 
-namespace UserFrosting\Sprinkle\Organisations\Database\Migrations\v010;
+namespace UserFrosting\Sprinkle\Organisations\Database\Migrations\v1_0_0;
 
 use Illuminate\Database\Schema\Blueprint;
 use UserFrosting\Sprinkle\Organisations\Database\Models\Organisation;
@@ -27,7 +27,7 @@ class OrganisationsTable extends Migration
      * {@inheritdoc}
      */
     public static $dependencies = [
-        '\UserFrosting\Sprinkle\Account\Database\Migrations\v400\UsersTable',
+        '\UserFrosting\Sprinkle\Account\Database\Migrations\v430\UpdateUsersTable',
     ];
 
     /**

src/Database/Seeds/OrganisationPermissions.php

@@ -50,6 +50,11 @@ class OrganisationPermissions extends BaseSeed
             'organisations-admin'  => Role::where('slug', 'organisations-admin')->first()->id,
         ];
 
+        $canAdminOrgUsers = "(has_role(self.id,{$roleIds['organisations-admin']}) || (has_matching_organisation(self.id,user.id,1) && !has_role(user.id,{$roleIds['organisations-admin']})))";
+        $canAdminOrgAdmins = "(has_role(self.id,{$roleIds['organisations-admin']}) || has_matching_organisation(self.id,user.id,1))";
+        $excludeMasters = "(!is_master(user.id) && !has_role(user.id,{$roleIds['site-admin']}))";
+        $isSelf = "equals_num(self.id,user.id)";
+
         return [
             'create_organisation' => new Permission([
                 'slug'        => 'create_organisation',
@@ -127,12 +132,6 @@ class OrganisationPermissions extends BaseSeed
             ]),
 
 
-            // 'view_organisation_members_field' => new Permission([
-            //     'slug'        => 'view_organisation_field',
-            //     'name'        => 'View organisation members field',
-            //     'conditions'  => "in(property,['members'])",
-            //     'description' => 'View members field of any organisation.',
-            // ]),
             'view_organisation_members' => new Permission([
                 'slug'        => 'view_organisation_field',
                 'name'        => 'View organisation members',
@@ -200,12 +199,12 @@ class OrganisationPermissions extends BaseSeed
             ]),
 
 
-            // 'uri_user_in_organisation' => new Permission([
+            'uri_user_in_organisation' => new Permission([
-            //     'slug'        => 'uri_user',
+                'slug'        => 'uri_user',
-            //     'name'        => 'View user',
+                'name'        => 'View user',
-            //     'conditions'  => "has_matching_organisation(self.id,user.id,true) && !is_master(user.id) && !has_role(user.id,{$roleIds['site-admin']}) && (!has_role(user.id,{$roleIds['organisations-admin']}) || equals_num(self.id,user.id))",
+                'conditions'  => "(($canAdminOrgAdmins && $excludeMasters) || $isSelf)",
-            //     'description' => 'View the user page of any user in your group, except the master user and Site and (global) Organisation Administrators (except yourself).',
+                'description' => 'View the user page of any user in your orgnisation, except the master user and Site and (global) Organisation Administrators (except yourself).',
-            // ]),
+            ]),
             'view_user_field' => new Permission([
                 'slug'        => 'view_user_field',
                 'name'        => 'View user',
@@ -215,35 +214,43 @@ class OrganisationPermissions extends BaseSeed
             'update_user_field' => new Permission([
                 'slug'        => 'update_user_field',
                 'name'        => 'Edit user',
-                'conditions'  => "!has_role(user.id,{$roleIds['site-admin']}) && subset(fields,['organisations'])",
+                'conditions'  => "$excludeMasters && subset(fields,['organisations'])",
                 'description' => 'Edit organisations for users who are not Site Administrators.',
             ]),
 
             'view_user_field_group' => new Permission([
                 'slug'        => 'view_user_field',
                 'name'        => 'View user',
-                'conditions'  => "equals_num(self.group_id,user.group_id) && !is_master(user.id) && !has_role(user.id,{$roleIds['site-admin']}) && (!has_role(user.id,{$roleIds['group-admin']}) || equals_num(self.id,user.id)) && in(property,['organisations'])",
+                'conditions'  => "equals_num(self.group_id,user.group_id) && $excludeMasters && (!has_role(user.id,{$roleIds['group-admin']}) || equals_num(self.id,user.id)) && in(property,['organisations'])",
                 'description' => 'View organisations of any user in your own group, except the master user and Site and Group Administrators (except yourself).',
             ]),
             'update_user_field_group' => new Permission([
                 'slug'        => 'update_user_field',
                 'name'        => 'Edit group user',
-                'conditions'  => "equals_num(self.group_id,user.group_id) && !is_master(user.id) && !has_role(user.id,{$roleIds['site-admin']}) && (!has_role(user.id,{$roleIds['group-admin']}) || equals_num(self.id,user.id)) && subset(fields,['organisations'])",
+                'conditions'  => "equals_num(self.group_id,user.group_id) && $excludeMasters && (!has_role(user.id,{$roleIds['group-admin']}) || equals_num(self.id,user.id)) && subset(fields,['organisations'])",
                 'description' => 'Edit organisations for users in your own group who are not Site or Group Administrators, except yourself.',
             ]),
 
-            'view_user_field_organisation' => new Permission([
+            'view_user_field_organisation_audit' => new Permission([
                 'slug'        => 'view_user_field',
                 'name'        => 'View user',
-                'conditions'  => "has_matching_organisation(self.id,user.id) && !is_master(user.id) && !has_role(user.id,{$roleIds['site-admin']}) && (!has_role(user.id,{$roleIds['organisations-admin']}) || equals_num(self.id,user.id)) && in(property,['user_name','name','email','locale','roles','group','activities','organisations'])",
+                'conditions'  => "(($canAdminOrgUsers && $excludeMasters) || $isSelf) && in(property,['activities'])",
                 'description' => 'View certain properties of any user in your own organisation, except the master user and Site and (global) Organisation Administrators (except yourself).',
             ]),
             'update_user_field_organisation' => new Permission([
                 'slug'        => 'update_user_field',
                 'name'        => 'Edit organisation user',
-                'conditions'  => "has_matching_organisation(self.id,user.id,1) && !is_master(user.id) && !has_role(user.id,{$roleIds['site-admin']}) && (!has_role(user.id,{$roleIds['organisations-admin']}) || equals_num(self.id,user.id)) && subset(fields,['name','email','locale','flag_enabled','flag_verified','password'])",
+
+                'conditions'  => "(($canAdminOrgUsers && $excludeMasters) || $isSelf) && subset(fields,['name','email','locale','flag_enabled','flag_verified','password'])",
                 'description' => 'Edit users in your own organisation who are not Site or (global) Organisation Administrators, except yourself.',
             ]),
+
+            'view_user_field_organisation' => new Permission([
+                'slug'        => 'view_user_field',
+                'name'        => 'View user',
+                'conditions'  => "(($canAdminOrgUsers && $excludeMasters) || $isSelf) && in(property,['user_name','name','email','locale','roles','group','organisations'])",
+                'description' => 'View certain properties of any user in your own organisation, except the master user and Site and (global) Organisation Administrators (except yourself).',
+            ]),
         ];
     }
 
@@ -304,6 +311,14 @@ class OrganisationPermissions extends BaseSeed
             ]);
         }
 
+        $roleUserAdmin = Role::where('slug', 'user-admin')->first();
+        if ($roleSiteAdmin) {
+            $roleSiteAdmin->permissions()->syncWithoutDetaching([
+                $permissions['view_user_field']->id,
+                $permissions['update_user_field']->id,
+            ]);
+        }
+
         $roleGroupAdmin = Role::where('slug', 'group-admin')->first();
         if ($roleGroupAdmin) {
             $roleGroupAdmin->permissions()->sync([
@@ -328,13 +343,15 @@ class OrganisationPermissions extends BaseSeed
 
                 $permissions['uri_organisation']->id,
                 $permissions['uri_organisations']->id,
+                $permissions['uri_user_in_organisation']->id,
                 $permissions['uri_deleted_organisations']->id,
 
                 $permissions['view_organisation_members']->id,
                 $permissions['promote_organisation_member']->id,
 
-                #$permissions['view_user_field']->id,
+                $permissions['view_user_field_organisation_audit']->id,
-                #$permissions['update_user_field']->id,
+                $permissions['view_user_field_organisation']->id,
+                $permissions['update_user_field_organisation']->id,
             ]);
         }
 
@@ -352,6 +369,7 @@ class OrganisationPermissions extends BaseSeed
 
                 $permissions['uri_organisation_own']->id,
                 $permissions['uri_organisations']->id,
+                $permissions['uri_user_in_organisation']->id,
 
                 $permissions['view_user_field_organisation']->id,
                 $permissions['update_user_field_organisation']->id,

templates/pages/user.html.twig

@@ -168,6 +168,7 @@
                 {% endblock %}
             </div>
         </div>
+        {% if checkAccess('view_user_field', { 'user': user, 'property': 'activities' }) %}
         {% if 'activities' not in widgets.hidden %}
         <div class="col-lg-8">
             {% block activity_box %}
@@ -188,6 +189,7 @@
             {% endblock %}
         </div>
         {% endif %}
+        {% endif %}
     </div>
     {% if 'permissions' not in widgets.hidden %}
     <div class="row">