Answers.Body: <p>I wish i would have seen this question earlier, I can certainly help you out. </p>
  
  <p>checkout civicrm_entity.api.php in the civicrm_entity module</p>
  
  <p>I don't believe the controller is checking the ACL's when loading an entity. We may be able to add 'check_permissions' => True to the call there in civcirm_entity_controller.inc CivicrmEntityController::loadEntites... food for thought, make a feature request in the civicrm_entity queue if you still need this. </p>
  
  <p>Alternatively</p>
  
  <p>There is a hook, hook_civicrm_entity_supported_info() that you can implement and add entities to be exposed by the module or alter settings for the currently exposed entities.  See the api information for full details. </p>
  
  <p>Here you can alter what permissions are necessary to view/add/edit/delete entities via the CiviCRM Entity Drupal based forms or even set a custom callback.</p>
  
  <pre><code>function MYMODULE_civicrm_entity_supported_info(&amp;$civicrm_entity_info) {
        $civicrm_entity_info['civicrm_contact'] = array(
          'permissions' =&gt; array(
            'access_callback' =&gt; 'MYMODULE_some_custom_callback_name'
          ),
        );
      }
  </code></pre>
  
  <p>This will tell CiviCRM Entity to use your custom callback instead of 'user_access' </p>
  
  <p>Your callback will look something like this:</p>
  
  <pre><code>    function MYMODULE_some_custom_callback_name($op, $entity_type, $entity, $account) {
        if (is_null($account)) {
          global $user;
          $account = $user;
        }
         if($entity_type == 'civicrm_contact' &amp;&amp; $op == 'view') {
           // fetch contact_id for user via a uf_match api get call
           // do your custom permission check
           $rules = getAllByContact($contact_id); //maybe get the acl rules for a contact
          // determine whether the contact can view with some code here
          // then assuming the contact can view the contact
          $contact_can_view = TRUE;
          // or if not
          $contact_can_view = FALSE;
           return $contact_can_view; 
         }
      }
  </code></pre>
  
  <p>see some useful information about getting ACL rules for a contact here:
  <a href="https://wiki.civicrm.org/confluence/display/CRM/Access+Control+List+Permissioning+Specification" rel="nofollow noreferrer">https://wiki.civicrm.org/confluence/display/CRM/Access+Control+List+Permissioning+Specification</a></p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-01-14T03:18:56.283Z
Answers.LastActivityDate: 2017-01-15T02:49:38.850Z
Answers.LastEditDate: 2017-01-15T02:49:38.850Z
Answers.UserDisplayName: jackrabbithanna
Body: <p>We are a federated political organisation migrating to CiviCRM 4.6. I have integrated  CiviCRM with Drupal views and civicrm_entity so we can create customised search pages for local organisers.</p>
  
  <p>I'm finding civicrm_entity and various fuzion extensions to be excellent help, but setting up permissions across a large grassroots organisation is still complex. We are currently managing this with a combo of permissioned relationships and auto-generated smart groups.</p>
  
  <p>Question:</p>
  
  <p>Currently, to view entity via <em>civicrm_entity</em> (at e.g. civicrm-contact/[id]), a user seems to require the 'view all contacts' Drupal permission.</p>
  
  <p>Is there an easy(ish) way to make <em>civicrm_entity</em> respect CiviCRM ACLs? Or at least check that the logged in user has permissioned relationship with that contact?</p>
  
  <p>thanks,
  L</p>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2016-11-21T15:37:18.677Z
Comments.Text: Update: in the meantime we are using permissioned relationships to allow access to a special view at _members/%_.
  So when a user visits_members/1234_ their relationship to the member via different Organisations (branches, committees, etc.) is checked and the view is only shown if the relationships are permissioned all the way down. This is working quite well so far.
Comments.UserDisplayName: Leckie
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-01-14T03:38:16.517Z
Comments.Text: This is how we have done a lot of this type of thing - using those Fuzion modules and daisy-chaining relationships between the member, their branch, the region of that branch, and all the way up, with officers who are 'related' to the branch or region therefore getting access down the tree.
Comments.UserDisplayName: petednz - fuzion
Tags: <permissions><acl><civicrm-entity>
Title: CiviCRM Entity and ACL Permissions
ThreadText: # CiviCRM Entity and ACL Permissions
  
  (Asked by: username_0 on 2016-11-13)
  
  We are a federated political organisation migrating to CiviCRM 4.6. I have integrated CiviCRM with Drupal views and civicrm\_entity so we can create customised search pages for local organisers.
  
  I'm finding civicrm\_entity and various username_1 extensions to be excellent help, but setting up permissions across a large grassroots organisation is still complex. We are currently managing this with a combo of permissioned relationships and auto-generated smart groups.
  
  Question:
  
  Currently, to view entity via *civicrm\_entity* (at e.g. civicrm-contact/[id]), a user seems to require the 'view all contacts' Drupal permission.
  
  Is there an easy(ish) way to make *civicrm\_entity* respect CiviCRM ACLs? Or at least check that the logged in user has permissioned relationship with that contact?
  
  thanks,
  L
  
  **Tags:** permissions, acl, civicrm-entity
  
  > **Comments:**
  > **username_0**: Update: in the meantime we are using permissioned relationships to allow access to a special view at _members/%_. So when a user visits_members/1234_ their relationship to the member via different Organisations (branches, committees, etc.) is checked and the view is only shown if the relationships are permissioned all the way down. This is working quite well so far.  
  > **username_1**: This is how we have done a lot of this type of thing - using those username_1 modules and daisy-chaining relationships between the member, their branch, the region of that branch, and all the way up, with officers who are 'related' to the branch or region therefore getting access down the tree.  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_2 on 2017-01-14. Score: 4 | Accepted answer
  
  I wish i would have seen this question earlier, I can certainly help you out.
  
  checkout civicrm\_entity.api.php in the civicrm\_entity module
  
  I don't believe the controller is checking the ACL's when loading an entity. We may be able to add 'check\_permissions' => True to the call there in civcirm\_entity\_controller.inc CivicrmEntityController::loadEntites... food for thought, make a feature request in the civicrm\_entity queue if you still need this.
  
  Alternatively
  
  There is a hook, hook\_civicrm\_entity\_supported\_info() that you can implement and add entities to be exposed by the module or alter settings for the currently exposed entities. See the api information for full details.
  
  Here you can alter what permissions are necessary to view/add/edit/delete entities via the CiviCRM Entity Drupal based forms or even set a custom callback.
  
  ```
  function MYMODULE_civicrm_entity_supported_info(&$civicrm_entity_info) {
        $civicrm_entity_info['civicrm_contact'] = array(
          'permissions' => array(
            'access_callback' => 'MYMODULE_some_custom_callback_name'
          ),
        );
      }
  
  ```
  
  This will tell CiviCRM Entity to use your custom callback instead of 'user\_access'
  
  Your callback will look something like this:
  
  ```
      function MYMODULE_some_custom_callback_name($op, $entity_type, $entity, $account) {
        if (is_null($account)) {
          global $user;
          $account = $user;
        }
         if($entity_type == 'civicrm_contact' && $op == 'view') {
           // fetch contact_id for user via a uf_match api get call
           // do your custom permission check
           $rules = getAllByContact($contact_id); //maybe get the acl rules for a contact
          // determine whether the contact can view with some code here
          // then assuming the contact can view the contact
          $contact_can_view = TRUE;
          // or if not
          $contact_can_view = FALSE;
           return $contact_can_view; 
         }
      }
  
  ```
  
  see some useful information about getting ACL rules for a contact here:
  <https://wiki.civicrm.org/confluence/display/CRM/Access+Control+List+Permissioning+Specification>
  
  
  ---
  
  