Add access capabilities

classes/field_base.php

@@ -337,38 +337,47 @@ protected function matches_internal($value) {
      * @param int $rulecount
      */
     public function add_form_field(MoodleQuickForm $mform, $values, $rulecount) {
+        $context = \context_system::instance();
+        $canmanagerules = has_capability('local/profilecohort:managerules', $context);
+
+        $selectattrs = ['class' => 'localprofile-value'];
+        if (!$canmanagerules) {
+            $selectattrs[] = 'disabled';
+        }
+
         $id = $this->get_form_id();
         $mform->addElement('hidden', "fieldid[$id]", $this->fieldid);
         $mform->setType("fieldid[$id]", PARAM_INT);
 
         $group = $this->add_form_field_internal($mform, $id);
         $valuelabel = html_writer::span(get_string('selectvalue', 'local_profilecohort'), 'localprofile-value');
         $group[] = $mform->createElement('static', "valuelabel[$id]", '', $valuelabel);
-        $group[] = $mform->createElement('select', "value[$id]", get_string('selectvalue', 'local_profilecohort'), $values,
-                                         ['class' => 'localprofile-value']);
+        $group[] = $mform->createElement('select', "value[$id]", get_string('selectvalue', 'local_profilecohort'), $values, $selectattrs);
         $mform->setDefault("value[$id]", $this->value);
 
         $prefix = '';
         if ($this->id) {
-            $group[] = $mform->createElement('static', '', '', '<br><span class="localprofile-rule-actions">');
-            if ($rulecount > 1) {
-                $moveopts = range(1, $rulecount);
-                $moveopts = array_combine($moveopts, $moveopts);
-                $group[] = $mform->createElement('static', "movelabel[$id]", '', get_string('moveto', 'local_profilecohort'));
-                $group[] = $mform->createElement('select', "moveto[$id]", get_string('moveto', 'local_profilecohort'), $moveopts,
-                                                 ['class' => 'moveto']);
-                $mform->setDefault("moveto[$id]", $this->formposition);
-                $group[] = $mform->createElement('static', '', '', '<br>');
-
-                $group[] = $mform->createElement('advcheckbox', "andnextrule[$id]", '',
-                                                 get_string('andnextrule', 'local_profilecohort'), ['class' => 'andnextrule']);
-                $mform->setDefault("andnextrule[$id]", $this->andnextrule);
-                $group[] = $mform->createElement('static', '', '', '<br>');
-            }
+            if ($canmanagerules) {
+                $group[] = $mform->createElement('static', '', '', '<br><span class="localprofile-rule-actions">');
+                if ($rulecount > 1) {
+                    $moveopts = range(1, $rulecount);
+                    $moveopts = array_combine($moveopts, $moveopts);
+                    $group[] = $mform->createElement('static', "movelabel[$id]", '', get_string('moveto', 'local_profilecohort'));
+                    $group[] = $mform->createElement('select', "moveto[$id]", get_string('moveto', 'local_profilecohort'), $moveopts,
+                                                    ['class' => 'moveto']);
+                    $mform->setDefault("moveto[$id]", $this->formposition);
+                    $group[] = $mform->createElement('static', '', '', '<br>');
+
+                    $group[] = $mform->createElement('advcheckbox', "andnextrule[$id]", '',
+                                                    get_string('andnextrule', 'local_profilecohort'), ['class' => 'andnextrule']);
+                    $mform->setDefault("andnextrule[$id]", $this->andnextrule);
+                    $group[] = $mform->createElement('static', '', '', '<br>');
+                }
 
-            $group[] = $mform->createElement('advcheckbox', "delete[$id]", '', get_string('delete', 'local_profilecohort'),
-                                             ['class' => 'deleterule']);
-            $group[] = $mform->createElement('static', '', '', '</span>');
+                $group[] = $mform->createElement('advcheckbox', "delete[$id]", '', get_string('delete', 'local_profilecohort'),
+                                                ['class' => 'deleterule']);
+                $group[] = $mform->createElement('static', '', '', '</span>');
+            }
 
             $prefix = '<span class="localprofile-number">'.$this->formposition.'</span>. ';
         }

classes/field_checkbox.php

@@ -54,8 +54,16 @@ protected function add_form_field_internal(MoodleQuickForm $mform, $id) {
             self::MATCH_NOTDEFINED => get_string('match_notdefined', 'local_profilecohort'),
         ];
 
+        $context = \context_system::instance();
+        $canmanagerules = has_capability('local/profilecohort:managerules', $context);
+        $selectattrs = [];
+
+        if (!$canmanagerules) {
+            $selectattrs[] = 'disabled';
+        }
+
         $label = $mform->createElement('static', "matchlabel[$id]", '', get_string('match_exact', 'local_profilecohort'));
-        $sel = $mform->createElement('select', "matchvalue[$id]", get_string('matchvalue', 'local_profilecohort'), $opts);
+        $sel = $mform->createElement('select', "matchvalue[$id]", get_string('matchvalue', 'local_profilecohort'), $opts, $selectattrs);
         $mform->setDefault("matchvalue[$id]", $matchvalue);
         return [$label, $sel];
     }

classes/field_menu.php

@@ -69,9 +69,17 @@ protected function add_form_field_internal(MoodleQuickForm $mform, $id) {
             $matchvalue = $this->matchtype;
         }
 
+        $context = \context_system::instance();
+        $canmanagerules = has_capability('local/profilecohort:managerules', $context);
+        $selectattrs = [];
+
+        if (!$canmanagerules) {
+            $selectattrs[] = 'disabled';
+        }
+
         $label = $mform->createElement('static', "matchlabel[$id]", '', get_string('match_exact', 'local_profilecohort'));
         $opts = [null => get_string('choosedots')] + $this->opts;
-        $sel = $mform->createElement('select', "matchvalue[$id]", get_string('matchvalue', 'local_profilecohort'), $opts);
+        $sel = $mform->createElement('select', "matchvalue[$id]", get_string('matchvalue', 'local_profilecohort'), $opts, $selectattrs);
         $mform->setType("matchvalue[$id]", PARAM_TEXT);
         $mform->setDefault("matchvalue[$id]", $matchvalue);
         return [$label, $sel];

classes/field_text.php

@@ -118,11 +118,20 @@ protected function add_form_field_internal(MoodleQuickForm $mform, $id) {
             $strmatchtype = 'match_'.str_replace('!', '', $matchtype);
             $matchopts[$matchtype] = get_string($strmatchtype, 'local_profilecohort');
         }
-        $type = $mform->createElement('select', "matchtype[$id]", get_string('matchtype', 'local_profilecohort'), $matchopts);
+
+        $context = \context_system::instance();
+        $canmanagerules = has_capability('local/profilecohort:managerules', $context);
+        $selectattrs = [];
+
+        if (!$canmanagerules) {
+            $selectattrs[] = 'disabled';
+        }
+
+        $type = $mform->createElement('select', "matchtype[$id]", get_string('matchtype', 'local_profilecohort'), $matchopts, $selectattrs);
         $mform->setType("matchtype[$id]", PARAM_TEXT);
         $mform->setDefault("matchtype[$id]", $this->matchtype);
 
-        $match = $mform->createElement('text', "matchvalue[$id]", get_string('matchvalue', 'local_profilecohort'));
+        $match = $mform->createElement('text', "matchvalue[$id]", get_string('matchvalue', 'local_profilecohort'), $selectattrs);
         $mform->setType("matchvalue[$id]", PARAM_TEXT);
         $mform->setDefault("matchvalue[$id]", $this->matchvalue);
         $mform->disabledIf("matchvalue[$id]", "matchtype[$id]", 'eq', self::MATCH_ISDEFINED);

classes/fields_form.php

@@ -73,7 +73,13 @@ protected function definition() {
         foreach ($rules as $rule) {
             $rule->add_form_field($mform, $values, count($rules));
         }
-        $this->add_action_buttons();
+
+        $context = \context_system::instance();
+        $canmanagerules = has_capability('local/profilecohort:managerules', $context);
+
+        if ($canmanagerules) {
+            $this->add_action_buttons();
+        }
 
         $PAGE->requires->js_call_amd('local_profilecohort/reorder', 'init');
     }

classes/profilecohort.php

@@ -71,6 +71,8 @@ public function output_form() {
         $out = '';
 
         if ($this->action == 'members') {
+            $context = \context_system::instance();
+            require_capability('local/profilecohort:seecohortmembers', $context);
             $out .= $this->output_members();
         } else {
             $out .= parent::output_form();
@@ -84,12 +86,20 @@ public function output_form() {
      * @return \tabobject[]
      */
     protected function extra_tabs() {
-        return [
-            new \tabobject('members', new \moodle_url($this->get_index_url(), ['action' => 'members']),
-                           get_string('members', 'local_profilecohort')),
-            new \tabobject('cohorts', new \moodle_url('/local/profilecohort/cohorts.php'),
-                           get_string('selectcohorts', 'local_profilecohort'))
-        ];
+        $tabs = [];
+        $context = \context_system::instance();
+
+        if (has_capability('local/profilecohort:seecohortmembers', $context)) {
+            $tabs[] = new \tabobject('members', new \moodle_url($this->get_index_url(), ['action' => 'members']),
+                                    get_string('members', 'local_profilecohort'));
+        }
+
+        if (has_capability('local/profilecohort:selectcohorts', $context)) {
+            $tabs[] = new \tabobject('cohorts', new \moodle_url('/local/profilecohort/cohorts.php'),
+                                    get_string('selectcohorts', 'local_profilecohort'));
+        }
+
+        return $tabs;
     }
 
     /**

classes/profilefields.php

@@ -105,6 +105,9 @@ public function process_form() {
 
         $addid = null;
         if ($this->action == 'add') {
+            $context = \context_system::instance();
+            require_capability('local/profilecohort:managerules', $context);
+
             // Add a new, empty, rule to the end of the list, if requested.
             if ($addid = optional_param('add', null, PARAM_INT)) {
                 $field = $DB->get_record('user_info_field', array('id' => $addid), 'id AS fieldid, name, datatype, param1',
@@ -247,10 +250,23 @@ protected function extra_tabs() {
      */
     protected function get_tabs() {
         $tabs = [];
-        $tabs[] = new \tabobject('view', new \moodle_url($this->get_index_url(), ['action' => 'view']),
-                                 get_string('viewrules', 'local_profilecohort'));
-        $tabs[] = new \tabobject('add', new \moodle_url($this->get_index_url(), ['action' => 'add']),
-                                 get_string('addrules', 'local_profilecohort'));
+        $context = \context_system::instance();
+
+        if (has_capability('local/profilecohort:viewrules', $context)) {
+            $title = get_string('viewrules', 'local_profilecohort');
+
+            if (has_capability('local/profilecohort:managerules', $context)) {
+                $title = get_string('vieweditrules', 'local_profilecohort');
+            }
+
+            $tabs[] = new \tabobject('view', new \moodle_url($this->get_index_url(), ['action' => 'view']), $title);
+        }
+
+        if (has_capability('local/profilecohort:managerules', $context)) {
+            $tabs[] = new \tabobject('add', new \moodle_url($this->get_index_url(), ['action' => 'add']),
+                                    get_string('addrules', 'local_profilecohort'));
+        }
+
         $tabs = array_merge($tabs, $this->extra_tabs());
 
         $tabtree = new \tabtree($tabs, $this->action);

cohorts.php

@@ -27,6 +27,9 @@
 require(__DIR__ . '/../../config.php');
 require_once($CFG->libdir.'/adminlib.php');
 
+$context = \context_system::instance();
+require_capability('local/profilecohort:selectcohorts', $context);
+
 global $PAGE, $CFG, $OUTPUT;
 
 $url = new moodle_url('/local/profilecohort/cohorts.php');

db/access.php

@@ -0,0 +1,67 @@
+<?php
+// This file is part of Moodle - http://moodle.org/
+//
+// Moodle is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Moodle is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * Local plugin "Profile field based cohort membership" - Plugin capabilities
+ *
+ * @package   local_profilecohort
+ * @copyright 2016 Davo Smith, Synergy Learning UK on behalf of Alexander Bias, Ulm University <[email protected]>
+ * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ */
+
+defined('MOODLE_INTERNAL') || die();
+
+$capabilities = array(
+    'local/profilecohort:viewrules' => array(
+        'riskbitmask'  => RISK_PERSONAL,
+        'captype'      => 'read',
+        'contextlevel' => CONTEXT_MODULE,
+        'archetypes'   => array(
+            'teacher'        => CAP_ALLOW,
+            'editingteacher' => CAP_ALLOW,
+            'manager'        => CAP_ALLOW
+        )
+    ),
+
+    'local/profilecohort:managerules' => array(
+        'riskbitmask'  => RISK_PERSONAL | RISK_DATALOSS,
+        'captype'      => 'write',
+        'contextlevel' => CONTEXT_MODULE,
+        'archetypes'   => array(
+            'manager'  => CAP_ALLOW
+        )
+    ),
+
+    'local/profilecohort:seecohortmembers' => array(
+        'riskbitmask'  => RISK_PERSONAL,
+        'captype'      => 'read',
+        'contextlevel' => CONTEXT_MODULE,
+        'archetypes'   => array(
+            'teacher'        => CAP_ALLOW,
+            'editingteacher' => CAP_ALLOW,
+            'manager'        => CAP_ALLOW
+        )
+    ),
+
+    'local/profilecohort:selectcohorts' => array(
+        'riskbitmask'  => RISK_PERSONAL | RISK_DATALOSS,
+        'captype'      => 'write',
+        'contextlevel' => CONTEXT_MODULE,
+        'archetypes'   => array(
+            'manager'  => CAP_ALLOW
+        )
+    )
+);

lang/en/local_profilecohort.php

@@ -24,6 +24,11 @@
 
 defined('MOODLE_INTERNAL') || die();
 
+$string['profilecohort:viewrules'] = 'View cohort rules.';
+$string['profilecohort:managerules'] = 'Add, change and delete cohort rules.';
+$string['profilecohort:seecohortmembers'] = 'See the users who are currently members of the cohorts.';
+$string['profilecohort:selectcohorts'] = 'Select cohorts to be managed.';
+
 $string['addintro'] = 'On this tab, you can add a new rule mapping a custom user profile field\'s value to a cohort the user will be added to.';
 $string['addrule'] = 'Add rule for custom user profile field ...';
 $string['addrules'] = 'Add new rule';
@@ -58,4 +63,5 @@
 $string['viewintro'] = 'On this tab, you define the rules mapping custom user profile fields to the cohorts the user will be added to.<br>
 The defined rules are processed in the order that they are displayed. However, a user matching multiple rules will be added to all the relevant cohorts.<br>
 Please note: When rules are changed, a background task will be scheduled to update all affected users - there will be a short delay (a few minutes, depending on the configuration of your scheduled tasks in Moodle and the cronjob on the Moodle server) before all user memberships in the cohorts are updated. Nevertheless, any user who logs in before the background task is finished will be updated immediately.';
-$string['viewrules'] = 'View / edit rules';
+$string['viewrules'] = 'View rules';
+$string['vieweditrules'] = 'View / edit rules';

settings.php

@@ -24,8 +24,6 @@
 
 defined('MOODLE_INTERNAL') || die();
 
-if ($hassiteconfig) {
-    $settingspage = new admin_externalpage('local_profilecohort', new lang_string('pluginname', 'local_profilecohort'),
-                                           new moodle_url('/local/profilecohort/index.php'), 'moodle/site:config');
-    $ADMIN->add('accounts', $settingspage);
-}
+$settingspage = new admin_externalpage('local_profilecohort', new lang_string('pluginname', 'local_profilecohort'),
+                                        new moodle_url('/local/profilecohort/index.php'), 'local/profilecohort:viewrules');
+$ADMIN->add('accounts', $settingspage);