I've been exploring ProcessWire for the past week and really like the simplicity, power, and flexibility. The site that I plan to build will have a member login, and also a member directory. I want members to be able to view the profiles of other members, but guest should not be allowed to view the member profiles. I have a 'member' role defined and have added additional fields to the user template.
I was experimenting with the access control for the user "pages", but wasn't getting the behavior I expected. I modified the user template to allow page view for the member role, expecting all selectors to filter appropriately. When I use selectors with a path for the users like this:
$pages->find("parent=/processwire/access/users, limit=50")
I get inconsistent results. The guest user usually ends up getting a non-empty page array, meaning it found users, even though the guest user doesn't have the member role, so should never get any users in the results. The results were fickle - some selectors worked as I expected, others didn't.
I did a similar experiment with regular pages, not the user "pages", and the results were what I expected. The results of the selector are filtered appropriately based on the role of the user executing the selector - only users with the member role got any user results.
The selector below worked consistently - guest never found any user pages since it doesn't have the member role.
$pages->find("template=user")
and I can add roles=member to remove the admin and guest users from the results.
This is mostly a theoretical question on what's the right way to search for members, since I am also adding the member role restriction to any page that would browse or access user pages, so no non-member would ever run these selectors. But what is the "right" way to get the list of members with access control applied?
Thanks,
--Sharon