Restricting a Craft Widget by User Permissions

Some­times our wid­gets will dis­play data or infor­ma­tion that isn’t appro­pri­ate for all con­trol pan­el users. Just because some­one has access to the Con­trol Pan­el doesn’t mean they are nec­es­sar­i­ly an admin user. 

Let’s look at our sam­ple project again, where we have our dep­re­ca­tion wid­get we cre­at­ed in this course. 

As it stands right now, any­one with con­trol pan­el access will be able to select and enable the DeprecWid­get on their dashboard.

I have a new user group I cre­at­ed for the con­tent team and a new user added to that team for test­ing our permissions.

The per­mis­sions of the Con­tent Team user group is such that they can access the con­trol pan­el and the con­tent sec­tions. How­ev­er, sup­pose I try to access the Util­i­ties sec­tion via the wid­get. In that case, I get a 403 For­bid­den response because that access­ing that part of the Con­trol Pan­el is for­bid­den per the user group permissions.

So, I want to man­age bet­ter who can see this wid­get based on per­mis­sions. For now, let’s make it so only admin users have access to the DeprecWidget. 

To do this, we’ll use the sta­t­ic method isSelectable() in the base Wid­get class that checks whether the user mak­ing the request should see the wid­get in the drop-down of avail­able widgets. 

isSelectable() returns a boolean, so we need to return true if we want the user to be able to select and use the wid­get, or false if we do not.

The isSelectable() method returns true by default, so any wid­get you cre­ate that doesn’t imple­ment the isSelectable() method will be avail­able to any­one with con­trol pan­el access.

The cri­te­ria for how we do this is up to us. Who should have access to the wid­get? Let’s start by restrict­ing based on whether or not the con­trol pan­el user is an admin user.

Restrict­ing Based on Admin User

We add the sta­t­ic method to our wid­get file (DeprecWidget.php). I will add it near the top because it’s more straight­for­ward when read­ing the code if we see this restric­tion ear­ly on in the file.

	public static function isSelectable(): bool
	{
			
	}

Now we need to find out if the cur­rent user, the one mak­ing this request, is an admin user. Craft makes that easy for us via the Craft::$app object and the getIsAdmin() method in the User class.

We just return what­ev­er getIsAdmin() return since it also returns a boolean and that’s what isSelectable is required to return, too:

	public static function isSelectable(): bool
	{
		return Craft::$app->getUser()->getIsAdmin();
	}

This new per­mis­sion check will only work for new instances of the wid­get. If the user already has the wid­get installed then it will con­tin­ue to function.

Now the wid­get is no longer returned. But if we look at an account that has admin rights, then the wid­get is still avail­able and selec­table via the drop-down list on the dashboard.

Restrict­ing Based on Permission

How­ev­er, using just admin is per­haps a bit too heavy-hand­ed of per­mis­sion check­ing. A user could not be an admin but still have access to the dep­re­ca­tion notices in the con­trol panel’s util­i­ties sec­tion. This is because Craft has the dif­fer­ent sec­tions of Util­i­ties bro­ken out as their own permissions:

![[Screen Shot 2021-06-01 at 2.47.17 PM.png]]

So this is nice because it allows us to be a bit more pre­cise with our imple­men­ta­tion. Instead of just requir­ing admin per­mis­sions, we can check that this cur­rent user has per­mis­sions to the Dep­re­ca­tion Warn­ings sec­tion of the Util­i­ties. If they do, then we can make the DeprecWid­get isSelectable() sta­t­ic method return True.

And, any user group could have this per­mis­sion select­ed, so we’ll remove our check for getIsAdmin() and replace it with a check for that par­tic­u­lar permission.

	public static function isSelectable(): bool
	{
		return Craft::$app->getUser()->checkPermission('utility:deprecation-errors');
	}

You can find the user per­mis­sions via the Craft doc­u­men­ta­tion or invoke this class method to return all avail­able user permissions.