limit moderators to only be able to edit profiles of users on selected plans

The above supplied usage is exactly what you should be using to alter a users usergroups based off subscription state. If you want it to apply to every plan then simply don't add the plan id condition to the auto action. You can even use a Greater Than or Equal To condition on the plan id so new plans would also match the PLAN_ID_HERE check. The usergroup change will not take place until their subscription is active.

Thankyou for your reply. I did try to implement this, but we have a number of plans and user groups and the combination was getting too difficult for me to manage, especially with the possibility of new plans and new user groups in the future. I don't doubt that this is the correct way to alter a user's usergroup based off subscription state, but I dont think its appropriate for our site. I prefer to let CBSubs manage the usergroups.

Thinking about my original aim, which was to limit moderators to only be able to edit (and view) profiles of users on selected plans, and remembering the fact that I was only altering the usergroups to provide a level of security for this; I think it would work to update the usergroups immediately before someone tries to access a profile - be it to view or edit it.

ie the trigger for my auto action is something like onBeforeUserProfileAccess

My question is, is there a trigger that is fired before the checks on the usergroups when someone attempts to view a profile or open it for editing ?
I could then use this trigger to update the usergroup of a profile in order to ensure that only appropriate moderators can view or edit the profile.


To explain a little about my requirements, (in case its helpful to know this)

Users can view and edit their own profiles.
Users are not able to view other users profiles.
Certain moderators can view and edit users profiles based on the moderators usergroup.

This is a simplification of the group structure that I'm using:
Public
- Active Users
- - Members 1
- - - Moderator 1
- - Members 2
- - - Moderator 2
- Registered

Plan1 puts subscribers into the Members1 group, Plan2 puts subscribers into the Members2 group.
Only Moderator1 should be able to view or edit the profiles of plan1 users. Only Moderator2 should be able to view or edit the profiles of plan2 users.

I have viewing levels:
'Active Users' which includes the 'Active Users' group
and
'Registered or Active Users' which includes the 'Active Users' group and the 'Registered' group

My AutoActions are
1. if the 'View Access Level' 'Has' 'Active Users' then 'Remove Usergroups' 'Registered'
2. if the 'View Access Level' 'Does Not Have' 'Registered or Active Users' then 'add Usergroup' 'Registered'

Thanks

I don't think you need ACL management beyond CBSubs then for what you're wanting to do. Just block access to the profile edit page using a Redirect action in CB Auto Actions. This would send them away from that users profile edit if they don't have permission to edit them.

Global
Triggers: onBeforeUserProfileEditDisplay
Type: Redirect
User: Automatic
Access: Non-Self
Conditions
1: Usergroups - Has - Members 1
2: Custom > Value: [cb:if user="#me" usergroup includes "MODERATOR_1_ID_HERE"]IS_MODERATOR[/cb:if] - Equal To - IS_MODERATOR
Action
URL: [cb:url location="profile" /]
Message:
Be sure to replace MODERATOR_1_ID_HERE with the usergroup id for Moderator 1. Since you can't currently select the usergroups condition to be based off the auto action user or the viewing user you have to use an IF substitution condition shown as the second condition above.

I'm not sure why you're against letting CB Auto Actions manage your usergroups though. I guess it could be an issue if you plan on making new plans regularly and constantly though.

krileon wrote: I don't think you need ACL management beyond CBSubs then for what you're wanting to do. Just block access to the profile edit page using a Redirect action in CB Auto Actions. This would send them away from that users profile edit if they don't have permission to edit them.

You're right. Your solution is much better. Thankyou

I would like something similar to prevent people from viewing profiles, too. What would be the appropriate trigger so that I can redirect users to prevent them from viewing a profile if they dont meet certain criteria.

Thanks

I would like something similar to prevent people from viewing profiles, too. What would be the appropriate trigger so that I can redirect users to prevent them from viewing a profile if they dont meet certain criteria.

Yup, that's doable. Same concept as above except use the onBeforeUserProfileDisplay trigger.

thanks