Let me preface this post by saying that though I have considerable experience with PHP, I am not familiar with Joomla in any meaningful sense. What follows is based on assumptions about how Joomla works and information I have gleaned from folks more familiar with this CMS than I am. I would be grateful if you would correct any misconceptions I have.
Fundamentally, this question boils down to: Is it possible for extensions to a Joomla component to define their own permissions?
Defining Permissions for a Component (this part works)
I develop on CiviCRM, a constituent relationship manager for nonprofits which integrates with Joomla, Drupal, WordPress, and Backdrop. CiviCRM is for the most part a standalone application; it integrates with the various CMSes by packaging itself as a module, component, etc., but its core logic is CMS-agnostic.
In the case of Joomla, CiviCRM defines its core permissions in the component's
access.xml file. These core permissions work as expected; Joomla's permissions UI renders them, and they can be ticked on and off like any other Joomla permission.
Programmatically Adding New Permission Definitions to a Component (this is where I need help)
Here's where things get tricky. Like Joomla, CiviCRM has an extension system, and extensions to CiviCRM may themselves define new permissions.
CiviCRM extension developers register new permissions by use of a hook function hook_civicrm_permission. CiviCRM core abstracts away the differences between the CMSes and registers extension-defined permissions with the host CMS (e.g., via its implementation of Drupal's hook function hook_permission). In every CMS besides Joomla, this has been worked out so that merely registering a new permission is sufficient to have it displayed alongside other permissions in the relevant UIs, have the CMS store which groups/roles have been granted the permission, and have the CMS enforce it.
As I understand it, Joomla's permissions management UI is built by consuming all the
access.xml files for all the Joomla components at run-time. As CiviCRM's extension-defined permissions do not exist in any
access.xml file, these permissions are not rendered in the form.
Are there other extensible extensions in the Joomla space? How do they deal with this scenario? The ideal solution would not require CiviCRM extension developers to package their CiviCRM extensions differently -- there's enough to learn about CiviCRM without getting into the particulars of each CMS! If there's a way to modify CiviCRM core (or perhaps make a change to Joomla) so that arbitrary CiviCRM extensions can pass arbitrary permission definitions to Joomla through CiviCRM core, such a solution would be preferable.
Things That Have Been Tried
- Hacking CiviCRM's
access.xmlto include permissions defined by extensions appears to work, but clearly this is a maintenance nightmare and a terrible user experience.
- Our tests show that the permissions are actually enforced if you manage to set them. In a test instance, we did so by hacking the database to set the desired permissions. Again, not a great user experience.
- I have also considered pretending the Joomla permissions UI doesn't exist and building a separate permissions UI just for CiviCRM on Joomla, but I'd still need to learn about Joomla's permission APIs, and I'd rather not fragment the user experience that way.