User groups: endpoints, rules and permissions
Endpoints of the system view of user groups, the rules for membership and deletion, logging, and access restricted to the super administrator.
This screen is the system's view of the framework's built-in user groups: a list with member count and number of system permissions per group, a form, and adding and removing members. Data is handled through the built-in models.
Data model
Table names carry the installation's own prefix in the database.
| Table | Role | Relation |
|---|---|---|
user_group | built-in user groups | the user's group ID points here |
user | built-in users | user_group_id |
Endpoints and process
| Endpoint | Behaviour |
|---|---|
usergroup.list, .form | list and form |
usergroup.usersearch | user search for adding members |
usergroup.useradd | moves the user into the group; the last Administrator cannot be moved out |
usergroup.userremove | moves the user to the default group |
usergroup.save | save; name at least 2 characters |
usergroup.delete | only a group without members; the Administrator group cannot be deleted |
The operations write to the central system log.
Permissions
isSuper()on every endpoint; function keys grant no access.- The
user/usergroup+listseed row is unclassified; the controller does not ask for it. add:canAction(add)only for showing the button; not classified in the seeds.debug: only the switch depends on it; the controller passes the list SQL to the template unconditionally.- No content scope: a group is installation-level data.
Known limitations
The list query text is present in the template even without permission; only the switch is hidden. The menu caption is hard-coded English text.