Is it possible to permit non-process-modules configurations for non superusers?

[blynx]

The title says it all, I wonder:

Is it possible to permit non-process-modules configurations for non superusers?

I tried to set up permissions on a module (MarkupSEO) like I would on a process module - but it didn't work ...

[LostKobrakai]

Did you do a modules>refresh?

[blynx]

Yup,
didn't work ... : /

created permission "markup-seo"
added that to a role, put role on user
added 'permission' => 'markup-seo' to module info
refresh

[Robin S]

10 hours ago, blynx said:

Is it possible to permit non-process-modules configurations for non superusers?

It's possible, but I don't think there is a way to limit the access to a single module. Module configuration uses the ProcessModule process. If you check the source for that class you can see the permission that is needed to get access to the process: 'module-admin'. So you can create that permission and give it to a role, but then they can configure any installed module, which would be quite dangerous. Also, the modules menu still doesn't appear for the role - you'd have to dig around in the admin theme modules to find out what prevents that menu item from rendering.

An alternative would be to create a custom Process module that provides the same config fields and then save to the MarkupSEO config on page save. Then you can give access to that one Process module.

[blynx]

10 hours ago, Robin S said:

An alternative would be to create a custom Process module that provides the same config fields and then save to the MarkupSEO config on page save. Then you can give access to that one Process module.

Thanks for the insight!
Yup. I was thinking about that and will go that route now - stay tuned

[Robin S]

13 hours ago, Robin S said:

So you can create that permission and give it to a role, but then they can configure any installed module, which would be quite dangerous.

I thought of another option around this: you could give the 'module-admin' permission to the role, and then use a hook to check which module is being requested and only allow access to a particular module.

$this->addHookBefore('ProcessModule::executeEdit', function($event) {
    if(!$this->user->isSuperuser() && $this->input->get->name !== 'MarkupSEO') {
        throw new WirePermissionException('You do not have permission to configure this module.');
    }
});

Now you just need to create a custom link in admin to the module config page, maybe using a simple Process module. Or I think AdminOnSteroids lets you add custom menu items - haven't tried it myself.

[adrian]

Just came across this need for the SEO module as well. I have posted this request: https://github.com/processwire/processwire-requests/issues/170

Until there is some progress on that, here is my hacky solution. I am sure it could be improved, but it works for now.

$this->addHookBefore('ProcessModule::executeEdit', function($event) {
    if(!$this->wire('user')->isSuperuser() && $this->wire('input')->get->name !== 'MarkupSEO') {
        throw new WirePermissionException('You do not have permission to configure this module.');
    }
});

$this->addHookAfter('ProcessModule::executeNavJSON', function($event) {
    if(!$this->wire('user')->isSuperuser()) {
        if($this->wire('input')->get->site === '1') {
	    // note \/admin\/module\/ - if your site admin is at /processwire/, then use: \/processwire\/module\/
            $event->return = '{"url":"\/admin\/module\/","label":"Modules","icon":"plug","list":[{"url":"edit?name=MarkupSEO","label":"MarkupSEO","icon":"gear"}]}';
        }
        else {
            $event->return = null;
        }
    }
});

 

That results in this - Modules > Site contains just the SEO link and all the others are empty.

 

Thanks @Robin S for the headstart on this!

[Robin S]

For any future readers of this thread, here is a module for this purpose: