User management for closed user group

[steve]

Hello,

I am new to processwire and this forum. To introduce myself: I have been a graphic designer for more than 30 years with older skills in print and newer skills in web application development. During the last years I've built some projects with pure PHP - not only single websites, but quite complex things like a public relations tool for a big company. Now I have been searching for a helper tool for future projects, and after a lot of search, trial and error I have  - finally, as I hope - found processwire.

I have read quite a lot in this forum and the processwire website, watched some videos and searched the web. I as well have read Rob's post from 2012-06-26 about the integration of Silex and processwire, which seems quite interesting for me too. (http://processwire.com/talk/topic/1403-template-engine/?hl=silex#entry13039)

Now, finally, my question:
Can processwire as stand-alone be the tool that fits my requirements?
Or would I need addidtional tools like Flourish or Silex (or whatever)? Will the user management out of the box be ready for my purpose?

The Site/application that I want to build has no public site aspect, think of it as a kind of "secret skyscraper database" like in the processwire demo, but it can only be viewed and edited by authenticated users (closed user group). The customer wants to search, view and edit the database (pages) and occasionally add oder delete some users with slightly different limited permissions. There should be a backend - accessible only for me as developer, but not for the customer's staff - for authentication, logging, file access  and e-mail traffic whith attached files chosen from the site/database.

These roles and users should be managed by the application:

Superuser and app builder (only me, none of the customer's staff):

• Has all permissions, may build and administer the whole application and its backend.

Super-User-Admin (only one or two accounts for responsible persons of the customer's staff)

• May edit roles (user-groups) and administer user-admins and normal users, but only equal or below his own permissions.
• May NOT view and edit templates neither for admin pages nor for site pages. Does not even need to know about the existence of templates. This seems to be a conflict, because the permission "administer users" in admin/access/roles is commented "role must also have template edit access".
• May view and edit site pages.

User-Admin (customer's staff):

• May administer users below his own permissions.
• May view and edit site pages.

User (customer's staff):

• May only view and edit site pages.

I know that my approach is quite theoretical for I have only build a few pages with processwire yet - I've just installed the 2.3.2 and looked at the pages there and am quite surpised by the clear and easy concept of this framework and content management system and am close to beeing convinced that I have found what I've been searching for.

Thank you!

[ryan]

Welcome to the forums Steve!

In ProcessWire "superuser" is a special role that can do everything, regardless of any access/permission settings. Managing fields templates and users is typically the job of superuser. 

May edit roles (user-groups) and administer user-admins and normal users, but only equal or below his own permissions.

If you've got a non-superuser with "user-admin" permission, then they won't be able to edit or add superusers. But they'll be able to edit/add anyone else. 

May NOT view and edit templates neither for admin pages nor for site pages. Does not even need to know about the existence of templates.

Templates and fields are only accessible to superuser. Actually you could add a template-admin or field-admin permission to a user to give them access to these things, but the need is very rare. That's why these permissions are not included by default with PW. 

This seems to be a conflict, because the permission "administer users" in admin/access/roles is commented "role must also have template edit access".

This is only the case if the user-admin is creating new roles and assigning them to templates. It doesn't sound like your user-admins would need that ability. 

May view and edit site pages.

Your admin user would have a role with page-edit permission, and you'd assign that role to any templates used by pages you want them to edit. 

User-Admin (customer's staff):

May administer users below his own permissions.

Beyond knowing that "superuser" is allowed to do anything, ProcessWire doesn't necessarily know that one role is beneath another, and I'm not sure that it could unless you had some of your own logic to it. So you'd probably want to create your own front-end user tool for this, use hooks, or modify the behavior of the existing ProcessUser module. You can do this relatively easily by copying the existing /wire/modules/Process/ProcessUser.module to /site/modules/ProcessUserCustom.module, modify it to work the way you want it, and edit the page /admin/access/users/ and change the "Process" field on that page to your custom version of it. Though if the intention is simply to have the ability to add or delete users easily, I think a front-end tool (or your own admin tool) would be simplest. That's because you could take out the role considerations (less for your editors to think or know about), handling that automatically based on your needs. 

All of your access control scenarios seem within the scope of the system, except for the one that needs to know about one user defined role being considered above another one. But there are numerous ways to handle that, like mentioned. 

[steve]

Thank you, Ryan, for your welcome an your detailed reply to my question.

Meanwhile I have continued searching and reading the forum, and combined with your remarks I now have moved from "close to beeing convinced" to "beeing absolutely convinced" of processwire as my future tool!

I will work out all of your suggestions and try to find and realize my user management concept in the front end. Beeing absolutely new to processwire I just wanted to avoid running into a dead end right at the start of my project. Now I know that there will be a solution within the scope of processwire, maybe with some additional code and customizing.

[ryan]

Sounds good Steve, we look forward to seeing you around here. When you get to the point of trying to accomplish specific access control scenarios, post more and we can help you solve them.