Answers.Body: <p>You can do it in reverse if regular users have only "access my cases" permission. If they need access to cases that aren't theirs they can be added as any role to that case which will let them see it. But it sounds like you want the default to be to allow at the start, so then at that point you're into some kind of coding anyway. But then rather than access hooks, your postprocess hook on a new case would add in all the other staff as a role unless the custom field says don't.</p>
  
  <p>If you want to generalize it, the custom field could be a multiselect list of groups, with the default being an "all staff" group.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-04-30T23:27:26.287Z
Answers.LastActivityDate: 2020-04-30T23:27:26.287Z
Answers.UserDisplayName: Demerit
Answers.Body: <p>I have an extension called CiviCase ACL which works similar to Activity ACL, but need to rewrite to support it for latest version of Civi. It does what it needs that is CRUD for specific user role based on case type with combination of Activity ACL to restrict activities. It does need a few hours of rewrite. </p>
  
  <p>I did ask for adding a hook to alter(selectwhereclause) query for filtering the case on case dashboard but was told either to replace the whole dashboard or rewrite the core code to use the API instead of query. Rewriting using the API is a huge work and I don't have much time since there is much going on in those queries and I doubt API3 or API4 will support such complex join queries and also don't want to integrate results by doing multiple API calls. So I may rewrite the dashboard or do some hack to filter the case.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-04-30T23:29:45.940Z
Answers.LastActivityDate: 2020-06-10T09:39:06.683Z
Answers.LastEditDate: 2020-06-10T09:39:06.683Z
Answers.UserDisplayName: Pradeep Nayak
Answers.Body: <p>I have used the related permissions module for that. you can use the relationship client - case manager to give access to the contact and with this also to the cases.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-07-01T16:27:22.163Z
Answers.Text: I am missing something here, but it sounds like what I'm looking for.  Basically I want to give permissions to view cases based on role assignment.  Is that what you are doing?  What's the "related permissions module" you are referring to?
Answers.UserDisplayName: G H
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-07-03T05:39:10.177Z
Answers.Text: The Module is [https://civicrm.org/extensions/relationship-permissions-acls] but my answer might not match your entire needs. It might work if the contact already exists. 
  If the contact first has to be added, and I guess, while adding a case, it is as first step necessary to add a contact, then you are not permissioned to see the contact. For that i use a line of code: adding a contact set a custom relationship i have called "contact owner", and with this relationship its allowed to see and edit the given contact (with the related permissions module).
Answers.UserDisplayName: lbl
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-07-03T05:50:52.557Z
Answers.Text: in addition, if you go that way take a look at the issue https://civicrm.stackexchange.com/questions/35848
Answers.UserDisplayName: lbl
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-07-13T18:53:01.420Z
Answers.Text: Ha!  Actually noticed that issue on WP and it was driving me crazy.  The test user couldn't see any contacts, but could see the cases, and then error-ed out.  Took a few minutes for my brain to catch up.  Thanks for the heads up!
Answers.UserDisplayName: G H
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-06-10T10:21:38.003Z
Answers.LastActivityDate: 2020-06-10T10:21:38.003Z
Answers.UserDisplayName: lbl
Body: <p>I have the following use-case: employees usually have access to all cases in CiviCRM, but occasionally there can be a sensitive case that must only be visible to users with a higher permission level.</p>
  
  <p>I looked at CiviCRM ACLs, but they do not seem to apply to Cases. I also found an old <a href="https://wiki.civicrm.org/confluence/display/CRM/ACLs+for+Activities+and+Cases" rel="nofollow noreferrer">make-it-happen campaign</a> but I don't think it happened.</p>
  
  <p>I'm tempted to create an extension that adds a "confidentiality" custom field to cases, which would restrict access to the case itself, as well as to the case activities. I might not be able to alter the queries for listings (search cases, search activities), but if the subject itself is not confidential, it would be an acceptable compromise (and eventually we can introduce hooks in those listings, if necessary).</p>
  
  <p>Has anyone ever done this? Any other solutions?</p>
  
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-04-29T21:27:03.530Z
Comments.Text: I came across the same situation recently. Did you ever find a solution?
Comments.UserDisplayName: Kristine
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-04-30T19:16:02.727Z
Comments.Text: @Kristine The issue was stalled, but I think the solution by Demerit is a good idea.
Comments.UserDisplayName: bgm
Tags: <civicase>
Title: CiviCase: How to handle confidential cases
ThreadText: # CiviCase: How to handle confidential cases
  
  (Asked by: username_0 on 2020-04-30)
  
  I have the following use-case: employees usually have access to all cases in CiviCRM, but occasionally there can be a sensitive case that must only be visible to users with a higher permission level.
  
  I looked at CiviCRM ACLs, but they do not seem to apply to Cases. I also found an old [make-it-happen campaign](https://wiki.civicrm.org/confluence/display/CRM/ACLs+for+Activities+and+Cases) but I don't think it happened.
  
  I'm tempted to create an extension that adds a "confidentiality" custom field to cases, which would restrict access to the case itself, as well as to the case activities. I might not be able to alter the queries for listings (search cases, search activities), but if the subject itself is not confidential, it would be an acceptable compromise (and eventually we can introduce hooks in those listings, if necessary).
  
  Has anyone ever done this? Any other solutions?
  
  **Tags:** civicase
  
  > **Comments:**
  > **username_1**: I came across the same situation recently. Did you ever find a solution?  
  > **username_0**: @username_1 The issue was stalled, but I think the solution by username_2 is a good idea.  
  
  ---
  
  ## 3 answers
  
  ### Answer by username_2 on 2020-04-30. Score: 1 | Accepted answer
  
  You can do it in reverse if regular users have only "access my cases" permission. If they need access to cases that aren't theirs they can be added as any role to that case which will let them see it. But it sounds like you want the default to be to allow at the start, so then at that point you're into some kind of coding anyway. But then rather than access hooks, your postprocess hook on a new case would add in all the other staff as a role unless the custom field says don't.
  
  If you want to generalize it, the custom field could be a multiselect list of groups, with the default being an "all staff" group.
  
  
  ---
  
  ### Answer by username_3 on 2020-04-30. Score: 1
  
  I have an extension called CiviCase ACL which works similar to Activity ACL, but need to rewrite to support it for latest version of Civi. It does what it needs that is CRUD for specific user role based on case type with combination of Activity ACL to restrict activities. It does need a few hours of rewrite.
  
  I did ask for adding a hook to alter(selectwhereclause) query for filtering the case on case dashboard but was told either to replace the whole dashboard or rewrite the core code to use the API instead of query. Rewriting using the API is a huge work and I don't have much time since there is much going on in those queries and I doubt API3 or API4 will support such complex join queries and also don't want to integrate results by doing multiple API calls. So I may rewrite the dashboard or do some hack to filter the case.
  
  
  ---
  
  ### Answer by username_4 on 2020-06-10. Score: 0
  
  I have used the related permissions module for that. you can use the relationship client - case manager to give access to the contact and with this also to the cases.
  
  > **Comments:**
  > **username_5**: I am missing something here, but it sounds like what I'm looking for.  Basically I want to give permissions to view cases based on role assignment.  Is that what you are doing?  What's the "related permissions module" you are referring to?  
  > **username_4**: The Module is [https://civicrm.org/extensions/relationship-permissions-acls] but my answer might not match your entire needs. It might work if the contact already exists.  If the contact first has to be added, and I guess, while adding a case, it is as first step necessary to add a contact, then you are not permissioned to see the contact. For that i use a line of code: adding a contact set a custom relationship i have called "contact owner", and with this relationship its allowed to see and edit the given contact (with the related permissions module).  
  > **username_4**: in addition, if you go that way take a look at the issue https://civicrm.stackexchange.com/questions/35848  
  > **username_5**: Ha!  Actually noticed that issue on WP and it was driving me crazy.  The test user couldn't see any contacts, but could see the cases, and then error-ed out.  Took a few minutes for my brain to catch up.  Thanks for the heads up!  
  
  ---
  
  