<p>As you've noted, this is a complex and would require a proper discovery and planning phase to sort out all the details.  Here are a few thoughts on each stage of the process that you discussed. It looks like Luke has approached the problem in a similar way in the comments above.</p>

<h3>User1 has a login to the site, and has access to user_1_report.pdf</h3>

<p>This could potentially be handled by a Craft Entries or Users Relations field.  You could let somebody relate a Report to the specific User who should be able to see it, or allow a User Profile to be related to several differnet Reports.  In whichever case, you could limit who has visibility to the reports in the front-end by only displaying Reports to Users who have the right relationship to them.</p>

<h3>User2 logs in and sends a request to User1 to view user_1_report.pdf</h3>

<p>This will need to be handled with a plugin.  I would approach the problem in two steps.  The first part of the problem is an email notification problem, and the second part is an action that will required changing the relationship or permissions of who has access to something. Depending on how secure you need things to be, there may also be a validation component to ensure that only a User that has received an invite is able to accept that invite.</p>

<p>There are likely some Email plugins that could help get you started with the Email notification part of this. We have built similar authentication workflows using Sprout Email. For the particular approval action that you need, it's likely you'll need to approach that as a separate custom plugin that handles the specific action you need.</p>

<h3>User1 receives a notification in their members area and can click Approve / Deny</h3>

<p>This is mostly addressed in my previous comment. When you trigger the notification email, you can make sure that the notification email includes a link to help the user Approve/Deny the request. In my discussion above, those Approve or Deny actions would probably be links to controller actions that handle the behavior you need, or to a page on your site that then allows the user to trigger the right action.</p>

<h3>User2 gains access to the user_1_report.pdf as a download link in their members area.</h3>

<p>Once the approval workflow is sorted out, this will likely just be handled in the same way as the first scenario – via a Relations field or some permission and the standard Twig code needed to output that data.  One option could be to have an "Approved Users" field on a Report Entry, and your custom action would trigger adding the invited user as a Relation to the Report that they were invited to.</p>

CC BY-SA 3.0
2015-08-23T13:08:06.427Z
Hi Ben, thanks for your detailed answer above. The project in question isn't happening anymore, but it's really handy to have this as a reference of something that is possible and how to achieve it in future. Thanks!
darylknight
CC BY-SA 3.0
2015-08-23T05:22:56.733Z
2015-08-23T05:22:56.733Z
Ben Parizek
<p>Complicated question regarding asset sharing for a client proposal.</p>

<p>The website to be built will contain reports uploaded by a super-admin. These reports will be PDFs, tagged by year and be about specific users. The users that the reports relate to will be registered members of the site, and will be able to view reports regarding themselves.</p>

<p>Users will be able to log in to their members area of the website (front-end), and <strong>send requests</strong> to view other users' reports, and <strong>approve requests</strong> from other users to view their own reports.</p>

<p><strong>Example</strong></p>

<ul>
<li>User1 has a login to the site, and has access to user_1_report.pdf</li>
<li>User2 logs in and sends a request to User1 to view user_1_report.pdf</li>
<li>User1 receives a notification in their members area and can click <strong>Approve / Deny</strong></li>
<li>User2 gains access to the user_1_report.pdf as a download link in their members area.</li>
</ul>

<p>Can anyone suggest how this might be implemented? I'm assuming that it needs to be done with a custom built plugin but I'd love to know if it's possible without.</p>

<p>If it is plugin-only and there are any Craft plugin developers available, let me know as there is a budget available for someone to build that area of the site if necessary.</p>

CC BY-SA 3.0
2014-10-28T13:18:04.643Z
i think this would be best with a plugin... will a super admin always be the only one that can upload the reports? when a user approves another people to see the report do they approve all reports or individual reports?
Luke Holder
CC BY-SA 3.0
2014-10-28T13:19:30.190Z
The super admin would be the only person who uploads reports, then gives access to the user it relates to. When a user approves a request to view the file, they would approve a specific report to be viewable by one user.
darylknight
CC BY-SA 3.0
2014-10-28T13:20:16.330Z
If approval of the request is enough, and you dont need to approve individual reports, a simple "friendship" plugin would be enough. I could build that for you. let me know, lukemh at gmail.com
Luke Holder
CC BY-SA 3.0
2014-10-28T13:23:41.827Z
You could make each report an entry and have a owner (the user who can give access to that report) and then have a user relationship field that list all users who have access. The plugin would simply email the person who owns the report and they could click a button to allow or deny the person which will just add the requestors user account to the relationship field.
Luke Holder
<assets>
Question regarding member-owned shared assets
# Question regarding member-owned shared assets

(Asked by: username_0 on 2014-10-28)

Complicated question regarding asset sharing for a client proposal.

The website to be built will contain reports uploaded by a super-admin. These reports will be PDFs, tagged by year and be about specific users. The users that the reports relate to will be registered members of the site, and will be able to view reports regarding themselves.

Users will be able to log in to their members area of the website (front-end), and **send requests** to view other users' reports, and **approve requests** from other users to view their own reports.

**Example**

* User1 has a login to the site, and has access to user\_1\_report.pdf
* User2 logs in and sends a request to User1 to view user\_1\_report.pdf
* User1 receives a notification in their members area and can click **Approve / Deny**
* User2 gains access to the user\_1\_report.pdf as a download link in their members area.

Can anyone suggest how this might be implemented? I'm assuming that it needs to be done with a custom built plugin but I'd love to know if it's possible without.

If it is plugin-only and there are any Craft plugin developers available, let me know as there is a budget available for someone to build that area of the site if necessary.

**Tags:** assets

> **Comments:**
> **username_1**: i think this would be best with a plugin... will a super admin always be the only one that can upload the reports? when a user approves another people to see the report do they approve all reports or individual reports?  
> **username_0**: The super admin would be the only person who uploads reports, then gives access to the user it relates to. When a user approves a request to view the file, they would approve a specific report to be viewable by one user.  
> **username_1**: If approval of the request is enough, and you dont need to approve individual reports, a simple "friendship" plugin would be enough. I could build that for you. let me know, lukemh at gmail.com  
> **username_1**: You could make each report an entry and have a owner (the user who can give access to that report) and then have a user relationship field that list all users who have access. The plugin would simply email the person who owns the report and they could click a button to allow or deny the person which will just add the requestors user account to the relationship field.  

---

## 1 answers

### Answer by username_2 on 2015-08-23. Score: 2 | Accepted answer

As you've noted, this is a complex and would require a proper discovery and planning phase to sort out all the details. Here are a few thoughts on each stage of the process that you discussed. It looks like Luke has approached the problem in a similar way in the comments above.

### User1 has a login to the site, and has access to user\_1\_report.pdf

This could potentially be handled by a Craft Entries or Users Relations field. You could let somebody relate a Report to the specific User who should be able to see it, or allow a User Profile to be related to several differnet Reports. In whichever case, you could limit who has visibility to the reports in the front-end by only displaying Reports to Users who have the right relationship to them.

### User2 logs in and sends a request to User1 to view user\_1\_report.pdf

This will need to be handled with a plugin. I would approach the problem in two steps. The first part of the problem is an email notification problem, and the second part is an action that will required changing the relationship or permissions of who has access to something. Depending on how secure you need things to be, there may also be a validation component to ensure that only a User that has received an invite is able to accept that invite.

There are likely some Email plugins that could help get you started with the Email notification part of this. We have built similar authentication workflows using Sprout Email. For the particular approval action that you need, it's likely you'll need to approach that as a separate custom plugin that handles the specific action you need.

### User1 receives a notification in their members area and can click Approve / Deny

This is mostly addressed in my previous comment. When you trigger the notification email, you can make sure that the notification email includes a link to help the user Approve/Deny the request. In my discussion above, those Approve or Deny actions would probably be links to controller actions that handle the behavior you need, or to a page on your site that then allows the user to trigger the right action.

### User2 gains access to the user\_1\_report.pdf as a download link in their members area.

Once the approval workflow is sorted out, this will likely just be handled in the same way as the first scenario – via a Relations field or some permission and the standard Twig code needed to output that data. One option could be to have an "Approved Users" field on a Report Entry, and your custom action would trigger adding the invited user as a Relation to the Report that they were invited to.

> **Comments:**
> **username_0**: Hi Ben, thanks for your detailed answer above. The project in question isn't happening anymore, but it's really handy to have this as a reference of something that is possible and how to achieve it in future. Thanks!  

---

