Skip to content

Manage dashboard access rights per Group and per User - #144

Open
MichaelRodriguesOficial wants to merge 8 commits into
pluginsGLPI:mainfrom
MichaelRodriguesOficial:main
Open

MichaelRodriguesOficial wants to merge 8 commits into
pluginsGLPI:mainfrom
MichaelRodriguesOficial:main

Conversation

@MichaelRodriguesOficial

@MichaelRodriguesOficial MichaelRodriguesOficial commented Jul 13, 2026 •

Copy link
Copy Markdown

Update to better manage access to the dashboards.

Checklist before requesting a review

  • I have performed a self-review of my code.
  • I have added tests (when available) that prove my fix is effective or that my feature works.
  • I have updated the CHANGELOG with a short functional description of the fix or new feature.
  • This change requires a documentation update.

Description

Currently, dashboard access can only be granted per Profile. This PR adds the ability to also grant (or deny) access per Group and per User, using the same rights mechanism (Profile::dropdownRight) already used for profiles.

  • Adds a new PluginMetabaseItemright class, mirroring PluginMetabaseProfileright, storing rights keyed by itemtype (Group or User) + items_id + dashboard_uuid.
  • Adds a new tab ("Metabase") on the Group and User forms, gated by the existing group/user UPDATE rights, to manage dashboard access for that group/user.
  • Access rights are now additive: a dashboard is shown on Central if the user's profile, any of their groups, or the user themselves has been granted READ access.
  • No changes to the existing profile-based rights: they keep working exactly as before, this is purely additive.

I did not add automated tests since the plugin doesn't currently have a test suite in place.

Screenshots:

Group User

Update to better manage access to the dashboards.
@stonebuzz
stonebuzz requested review from Rom1-B and stonebuzz July 17, 2026 07:28
@stonebuzz stonebuzz assigned stonebuzz and unassigned stonebuzz Jul 17, 2026
@stonebuzz stonebuzz added the enhancement New feature or request label Jul 17, 2026
Comment thread inc/itemright.class.php Resolved
Comment thread inc/itemright.class.php Resolved
Comment thread inc/dashboard.class.php Resolved
Comment thread inc/dashboard.class.php Resolved
Comment thread inc/itemright.class.php Resolved
Comment thread inc/itemright.class.php Resolved
Comment thread inc/itemright.class.php Resolved
MichaelRodriguesOficial and others added 4 commits July 23, 2026 17:42
Co-authored-by: Stanislas <skita@teclib.com>
Co-authored-by: Stanislas <skita@teclib.com>
Co-authored-by: Stanislas <skita@teclib.com>
Co-authored-by: Romain B. <8530352+Rom1-B@users.noreply.github.com>

@Rom1-B Rom1-B left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Several errors in the CI

Comment thread inc/itemright.class.php Resolved
@MichaelRodriguesOficial
MichaelRodriguesOficial marked this pull request as draft September 1, 2026 21:38
@MichaelRodriguesOficial
MichaelRodriguesOficial marked this pull request as ready for review September 2, 2026 16:14
@MichaelRodriguesOficial
MichaelRodriguesOficial marked this pull request as draft September 2, 2026 16:24
@MichaelRodriguesOficial
MichaelRodriguesOficial marked this pull request as ready for review September 2, 2026 18:24

@Rom1-B Rom1-B left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please correct the CI issues before requesting another review.

Michael Rodrigues and others added 2 commits October 16, 2026 14:36
- Fix PHP syntax error introduced by the docblock suggestion in itemright.class.php
- Render the rights matrix with a Twig template (no more echo)
- READ on the group/user is enough to see the tab, UPDATE is required to save
- Check rights on the targeted group/user itself, not only the global right
- Rename dashboard_uuid column to dashboard_id
- Add int type hint and docblock on canCurrentUserViewDashboard()
- Remove rights when a group or user is purged
- Rebase on GLPI 12 / 1.5.0 and add CHANGELOG entry

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0115rGXdmY7mffoJzXeFPGhw
@MichaelRodriguesOficial

Copy link
Copy Markdown
Author

Thanks for the reviews, and sorry for the noise — the CI failures came from a suggestion I applied
through the web UI that broke a docblock and caused a PHP syntax error. On top of that, my previous
rework had been pushed to another branch, not to the one this PR uses.

This is now fixed and rebased on 1.5.0 / GLPI 12:

  • Rights matrix rendered with a Twig template (no more echo)
  • READ on the group/user shows the tab, UPDATE is required to save (same as Profileright);
    rights are checked on the targeted item itself
  • dashboard_uuid renamed to dashboard_id
  • int type hint + docblock on canCurrentUserViewDashboard() as suggested
  • Rights are cleaned when a group/user is purged
  • CHANGELOG entry added

Lint, PHP-CS-Fixer, PHPStan, Psalm, Rector, TwigCS and licence headers pass locally against GLPI 12,
as well as plugin install/uninstall.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants