Forum Discussion

SterlingLong1's avatar
SterlingLong1
Qrew Trainee
6 years ago

Target Group and "Only Group's Records"

Hello!

I have permissions in my app set up in such a way that it will only show records that belong to the "Target Group" of a user.
There is relatively little documentation on this feature, and I was wondering if anyone could shed some light on how it works, because it does work for my needs, but I have no idea how exactly it is working...

My guess is that when a person makes a record while in the group, that record is "assigned" to the group he is under. Then, if the user is moved out, and if other users are added to the group that has access to that record, they can all see and modify it even though the original creator is no longer present. 
Am I thinking along the right track here? Is there more to it?
Just looking for some possible clarification! Thank you!

------------------------------
- Sterling Long!
------------------------------
roles and permissions
User and group management
  • RossonLong1's avatar
    RossonLong1
    Qrew Cadet
    6 years ago
    After further testing here is what we have found:
    The "Target Group" that the user is in seems to be controlling what group the record is associated with when it is added. The user adding that record to the target group he/she is within must also be a member of the group that that record was added into. Otherwise the record will not visible to the creator (because they aren't a member of the group that the record now exists within).

    We have been having some weird problems where we have records that are visible to people in two separate groups.
    Record 1 was made in group 1 with the target group of the creator set to group 1
    Record 2 was made in group 2 with the target group of the creator set to group 2
    Record 3 was made in group 2 with the target group of the creator set to group 2

    Record 1 is visible by people associated with group 1 and group 2?!
    Record 2 & 3 are not visible by those in group 1.

    We cannot figure out what group a record is associated with when it is created. What determines this? What determines what group(s) the record is associated with and is there any way to see what group the record is associated with?

    ------------------------------
    Rosson Long
    ------------------------------
    • RossonLong1's avatar
      RossonLong1
      Qrew Cadet
      6 years ago
      Now I have created a record where the user that created the record only existed in 1 group. (I removed him from every group but one). I also set their target group to that specific group that I had them in. Once the record was created I tested as a user that was also added to that group with the same group permissions to see if I could see it. Worked fine.

      I then tested as a user who wasn't in our group. They could see the record that I had created that was associated with that one group! This user had no association at all to the that group and yet they can see the record I created in that group, using a user with the group role permissions applied.

      Am I doing something wrong? Does Modify also need to be set to the user group records and not set to "All Records?" In order for this to work? I figured restricting vision would be enough to set a record up and associate it with the group.

      Further testing: I have now removed the user from the group who originally created the record and added him to a different group. By removing the user from the group they were in I have now lost all vision of the record from every single account but the admin accounts.

      I can't seem to wrap my head around what is going on/how the group record permissions role works.

      ------------------------------
      Rosson Long
      ------------------------------
      • MarkShnier__You's avatar
        MarkShnier__You
        Icon for Qrew Legend rankQrew Legend
        6 years ago
        Maybe we should get back to your business purpose and just find a better way to do this.  I have been using Quick Base since 2002 and i have never found a need to use "groups" like that for permissions.  Why don't you state your business objectives and we will be able to suggest a different solution which is more transparent and predictable in its behavior.

        mark

        ------------------------------
        Mark Shnier (YQC)
        Quick Base Solution Provider
        Your Quick Base Coach
        http://QuickBaseCoach.com
        mark.shnier@gmail.com
        ------------------------------