Extend BuddyPress permissions system for our needs

[rgilman]

We need a more granulated permission system than standard BP provides. Their standard set – which includes public, private and hidden groups – would likely work for Graduates but not for Explorers. Explorers need to have all other groups on the site hidden. We are likely to also want the ability to invite guests into specific groups (with their forums) but also hide the rest of the site from them.

When someone feels ready to get into this issue, I'm happy to provide more detail.

[iangilman]

Any thoughts about where would be a good place to research how to do this?

[rgilman]

Here are some places to start:
WordPress Roles and Capabilities
BuddyPress Group Settings and Roles
bbPress User Roles and Capabilities

I recommend installing the Members plugin as a way to at least explore the roles and capabilities we currently have.

BP offers another user dimension that might be useful for distinguishing between Graduates, Explorers and Guests:
BuddyPress Member Types
See also http://buddypress.wp-a2z.org/oik_api/bp_register_member_type/
The BuddyPress Member Type Generator plugin provides a window into this functionality.

I assume that once we have various roles, capabilities and types defined we can use these to guide what any particular user can do.

[rgilman]

I've been doing some research tonight and came across:

• BuddyPress Action Hook Sequence During Startup
• and from that found bp_template_redirect() – "The main purpose of this hook in BuddyPress is to redirect users who do not have the proper permission to access certain content."

I would think we'd want to be able to do that with Explorers and Guests.

[rgilman]

Last night I posted a question on the BuddyPress support forum and got a helpful response.

I expect the following code will give us the starting point we need.

/**
 * Restrict user from accesisng groups of which he/she is not a member and it's not allowed as part of their member type.
 */
function buddydev_restrict_group_access_based_on_member_type() {

	if ( ! is_user_logged_in() || ! bp_is_group() || is_super_admin() ) {
		return;// it's not group or the user is not logged in, do not restrict.
	}

	$group_id = groups_get_current_group()->id;
	$user_id  = bp_loggedin_user_id();

	// user's own group, do not restrict.
	if ( groups_is_user_member( $user_id, $group_id ) ) {
		return;
	}

	// Member types pro is not active, return.
	if ( ! function_exists( 'bpmtp_member_types_pro' ) ) {
		return;
	}

	// Get all member types for user, user may have multiple member type.
	$member_types = bp_get_member_type( $user_id, false );

	if ( empty( $member_types ) ) {
	    return ;
		// what should we do? the user does not have any member type.
	}

	// let us build a list of group ids allowed with these member types.
	$group_ids = array();

	$active_types = bpmtp_get_active_member_type_entries();

	foreach ( $member_types as $member_type ) {
		// not valid.
	    if ( empty( $member_type ) || empty( $active_types[ $member_type ] ) ) {
			continue;
		}

		$mt_object            = $active_types[ $member_type ];
		$associate_groups_ids = get_post_meta( $mt_object->post_id, '_bp_member_type_groups', true );
	    // merge.
		if ( ! empty( $associate_groups_ids ) ) {
			$group_ids = array_merge( $group_ids, $associate_groups_ids );
		}
	}

	if ( ! empty( $group_ids ) && in_array( $group_id, $group_ids ) ) {
		return;// this group is associated with the member types the user has, so do not restrict.
	}

	// Restrict if we are here,
	$referrer = wp_get_referer();
	$referrer = $referrer ? $referrer : site_url( '/' );
	// add notice.
	bp_core_add_message( 'Access restricted', 'error' );
	bp_core_redirect( $referrer );
}

add_action( 'bp_template_redirect', 'buddydev_restrict_group_access_based_on_member_type' );

We can't just copy & paste this since it uses functions specific to the BuddyPress Member Types Pro plugin but it gives us the pattern we need.

[iangilman]

Fantastic!

@wunluv Sounds like you might be working on this one? Shall we assign it to you?

[wunluv]

@iangilman rather leave it open until I start working on it. That way if someone gets to it sooner...

[iangilman]

Fair enough :)