User has access despite permissions

đź’¬ General Discussion
1

Hello!

I have a setup of SuiteCRM 8.8.0, where one group of users has owner-only access to records (let’s say in Opportunities module) and another one has group-wide access to them.

My intention is to let people do everything with their own records by default and let someone be a moderator, see and edit selected records (not all of them). Roles are set up accordingly.

So a record has two groups:

  1. Default owner-only group inherited automatically;
  2. Group-wide group that’s assigned manually to needed records.

Now, I have a moderator user, who has said groups. In my understanding, he should see his own records AND ones which given the group-wide group.

But testing shows, that while the user indeed can’t interact in any way with records that don’t have the group-wide group assigned or not his own, and vice versa, he still can see all of them in the list view!

Somehow as soon as I assign the group-wide group to the user, he’s enabled to see not only his own records, but all records of all users of the owner-only group.

Now I’m a bit lost. It seems that two different permissions of the role for the group-wide group have two different kind of logics:

  1. View permission works as I initially planned: it lets any user in group-wide group see any record that has it;
  2. List permission instead somehow applies group permissions to another group (the owner group) and list of owner-only records are now available to anyone who has the group-wide group. Which shouldn’t happen?

Is it a bug? Or just some intricacies of CRM which I’m not aware of?

Thanks!

2

Check out the details in the doc:

3

The granting of accesses is cumulative. If a user gets access through the “Group-wide group that’s assigned manually to needed records”, that’s it, he gets access, regardless of the rest of the factors.

Does this explain what you’re seeing?

4

I suspected that it’s the case as I was reading the docs. But it doesn’t explain why is that that he can’t interact with the records even though he can see them? Haven’t he already gained access via the group? Cumulative as you have said? Both list and view (and the others actually too) permissions in that group have the same level of access: group.

Why different logic?

5

Thanks, I’ll watch them. Maybe I missed something.