Thread Details
  • State Verified Answer
  • Replies 9 replies
  • Subscribers 367 subscribers
  • Views 2183 views
  • Users 0 members are here
Forum Actions

Contacts many_to_many relationship with Users - how to use?

Gregory Kenenitz

If you navigate to Admin -> Studio -> Contacts -> Relationships, you will see that Contacts has a many-to-many relationship with Users. 

I cannot access a contact's users via the API. I've tried `Contacts/:id/link/users`, `Contacts/:id/collection/users`, `Contacts/:id/link/contacts_users`, and `Contacts/:id/link/contacts_users`. How exactly can we access this relationship via the API?

Context: we are using SugarCRM as an API for a custom frontend, and we would like to leverage the many-to-many relationship between contacts and users to set up restricted visibility for assigned users. I'm aware that SugarCRM has a default assigned_user field, but we need to assign more than one user to contacts. 

Parents
  • 0

    I think that you would want to use the Teams functionality to restrict access and Team-Based Permissions. 

  • 0 in reply to Jeff Bickart

    This won't work for us since we don't want the rigidity of teams. This will be similar to, say, Google Docs, where you can add or remove users on an individual level for each doc.

    I may just create an additional many-to-many relationship to handle this.

  • +1 Sugar Employee Badge in reply to Gregory Kenenitz

    The link name is user_sync (see modules/Contacts/vardefs.php), so 'Contacts/:id/link/user_sync' would return a contact's users. Coming from users, the link name is contacts_sync (see modules/Users/vardefs.php).
    But the contacts_users relationship is used for contact syncing with the MS Outlook Plug-in.

    As Jeff said, Teams and Team-Based Permissions should do what you want. Remember that for every user in Sugar, a corresponding private team is automatically created. So you can add or remove access for individual users by adding/removing their private teams.

  • 0 in reply to Claus Schiller

    Last question here:  if I am an admin-level user with API access, I can still access resources even if I'm not on an assigned team. For example, if there's a Note and the only associated team is Team Claus, I still see that note when I GET /Notes.

    Is there an easy way for me to make an API request that only fetches resources to which I have access (i.e. Global, or any team which is also associated with that resource) other than using filter params? I haven't found anything yet so I thought I'd ask here, plus filter params would not provide the security we would like (I would have to add logic hooks to make sure we don't return resources to which a given user does not have access).

Reply
  • 0 in reply to Claus Schiller

    Last question here:  if I am an admin-level user with API access, I can still access resources even if I'm not on an assigned team. For example, if there's a Note and the only associated team is Team Claus, I still see that note when I GET /Notes.

    Is there an easy way for me to make an API request that only fetches resources to which I have access (i.e. Global, or any team which is also associated with that resource) other than using filter params? I haven't found anything yet so I thought I'd ask here, plus filter params would not provide the security we would like (I would have to add logic hooks to make sure we don't return resources to which a given user does not have access).

Children