Yii2: specific form field editable based on Role - php

Question

Well, I can restrict users access permissions(i.e. view, create, update or delete) to forms or views based on access control using behaviors.
But I wonder how I can restrict a specific user from editing some of the fields in the form i.e. allow specific fields is read-only for some users and editable by some users.
Can I provide any kind of access rule in the model or attach some rule in the _form.php itself.
Thanks.

Answer 1

Try this.
if(\Yii::$app->user->can('admin')) {
$form->field($model,'field')->textInput();
}
In this case the input field will only appear if condition matches.

Answer 2

For exactly this case I've created my own class that extends ActiveForm. With the code below it's possible to add rules to a specific field for one or more roles. I use it like this in my forms:
<?= $form->field($model, 'foo', [], [AccessUtil::USER_ROLE => RoleBasedActiveForm::INVISIBLE]) ?>
The Role Based Active Form will show a normal input field when you don't add any rules. It won't display anything if you say it should be invisible for a roles and it also supports read-only (UNEDITABLE).
class RoleBasedActiveForm extends ActiveForm {
const VISIBLE = 0;
const INVISIBLE = 1;
const UNEDITABLE = 2;
public function field($model, $attribute, $options = [], $rules = []) {
$case = empty($rules) ? self::VISIBLE : $this->_validateRules($rules);
switch ($case) {
case self::VISIBLE:
return parent::field($model, $attribute, $options);
case self::INVISIBLE:
return;
case self::UNEDITABLE:
return parent::field($model, $attribute, array_merge($options, [
'template' => '{label}' . $model->$attribute,
]));
}
}
private function _validateRules($rules) {
// validate and return a const
}
}
This will do the form part. You will also have to do some validation after posting the values of course, to make sure someone hasn't modified the form. (changed read only to editable with the inspector or something)

Answer 3

Yes it can be done easily as far ur requirement is concerned without resorting to any utilities.
Try this code:
$form->field($model,'field')->textInput(['disabled' => !\Yii::$app->user->can('admin')]);
you need to replace ur field name and admin with your user role. In the above example only admin can edit this field, for other users it will show as disabled or readonly.
That's it.

Answer 4

This is a better answer. You put this in the validation either inline or as a separate function.
[[ 'input-name' ],
function ($attribute, $params) {
$user_role_array = Yii::$app->authManager->getRolesByUser(Yii::$app->user->getId());
if( !array_key_exists( "Role Name", $user_role_array ) ) {
$myOldA = ( $this->getOldAttribute( $attribute ) );
if( $this->{$attribute} !== (string) $myOldA ) {
$this->addError($attribute, "Please contact XXXXX to modify this option. The field has been reset. You may now resubmit the form" );
$this->{$attribute} = $myOldA;
} //End of if attribute equals old attribute
} //End of if array key exists
}, 'skipOnEmpty' => false, 'skipOnError' => false ],
[Next Rule if inline validation]