SilverStripe add custom security Group - php

Question

On SS 4.0.3 following this guide and the official doc, I successfully created a custom permission role.
Now I would create a custom group and add the default admin to it, as action performed by default in order to maintain those user/group/role settings either if the DB being dropped. I googled around many times but I didn't found any detailed tutorial to achieve this (using the Group class, the right place to implement this logic and so on).
Could anyone show me the way?
Thanks in advance.

Answer 1

If you want to enforce a data structure you can use DataObject::requireDefaultRecords. See Group::requireDefaultRecords for an example of this, it runs on dev/build every time.
You will want to check whether the data you're creating exists before doing so though, to ensure you don't create the group every time.

Answer 2

I successfully setted up the panorama described on my question, thanks to #robbie and other sources that I combined all in one, in order to achieve my goal (I'll list them here below). I wanna share my approach to those could be face this logic in the future.
In the first place I created a brand new standard/global permission with providePermissions() in the PageController (see balbuss.com source).
Next, as #robbie suggested, I created a Group DataExtension in order to build up a new group and setted my previously created permission on it (see #Barry's solution source).
To add the default admin to this group, I had to create a new Permission DataExtension in which I assigned the group to the proper member (see #StefGuev suggestion source):
// Definizione Namespace
use SilverStripe\ORM\DataExtension;
use SilverStripe\Security\DefaultAdminService;
use SilverStripe\Security\Member;
use SilverStripe\Security\Group;
class PermessoExtension extends DataExtension
{
/**
* Metodo gestione inizializzazione records di default
* Setter
* #return void
*/
public function requireDefaultRecords()
{
parent::requireDefaultRecords();
$userAdmin = DefaultAdminService::getDefaultAdminUsername();
$admin = Member::get()->filter('Email', $userAdmin)->first();
$gruppo = Group::get()->filter('Code', 'negozianti')->first();
// Controllo gruppo
if (!$admin->inGroup($gruppo->ID)) {
$admin->Groups()->add($gruppo);
$admin->write();
}
}
}
I made this choice because during dev/build, Permission being built after Member table, so I could get the default admin without errors.
Special thanks to these sources:
balbuss.com
Bereusei's solution
Barry's solution
StefGuev suggestion