Visible calendars/events not scoped to user calendar permissions

[myleshyson]

Describe the bug or issue you're experiencing
I'm noticing that if a user has permissions scoped so that they can only manage events in a specific calendar, they can still see all events/calendars when looking at the month/day/week view. I know you can turn off the mini calendar view but that's not exactly going to work for our use case. We're a university health system and going to have dozens of calendars that various people will manage. Some may manage 1, others may manage 5, and for both it'll be nice if they can only see the calendars they manage while also having the flexibility to hide/show events from different calendars. Here's an example of what I'm talking about.

User only has permissions to manage College of Medicine Events

That user sees all registered calendars/events in their view.

It seems a quick fix would be to use craft.calendar.allowedCalendars instead of craft.calendar.calendars in the twig template rendering those views.

Steps to reproduce

1. Scope calendar permissions for a user.
2. When logging in as that user, on the calendar view, see all registered calendars.

Expected behavior
When a user logs in to manage calendars, they should only be able to see calendars they have permissions to see.

Craft & Plugin Info (please complete the following information):

• Craft Version: 3.7.41
• Calendar Version: 3.3.12

[kjmartens]

Sorry for the delay @myleshyson. This is how Calendar is designed to work, given the assumed scenario is that public events are created and displayed on the front end, there would be no harm in events appearing in the control panel. I definitely understand there are other use-cases. What you propose has some merit, but it could break the expectations of other customers.

This would be best suited as a setting that could be toggled. I have made a note about this and we'll consider adding support for it. 🙂

[outline4]

I don't think that if you deselect a certain calendar within a usergroup that the expectation is to still see all events from all calendars. Doesn't your assumption defy the purpose of choosing calendars for different user groups in the first place. I mean it's a setting for the backend and should have nothing to do with the output of the frontend.

Maybe you need reconsider your expectation of this issue. It seems counter intuitive for me. But I could be wrong, since you certainly must know many customers with many opinions.

But I feel @myleshyson

[myleshyson]

I think a setting or even just an event for us to hook into, maybe here, would work great! Just something where we can control visible calendars in the CP based on user permissions.

[myleshyson]

I ended up getting around this by overriding the twig craft.calendars variable. I still think an event to hook into would be nice but this works for now.

 /** Ensure cp users only see the calendars they have permission to. */
Event::on(CraftVariable::class, CraftVariable::EVENT_INIT, function (Event $event) {
    $event->sender->set('calendar', CalendarVariableOverride::class);
});

<?php

namespace modules\calendar;

use Solspace\Calendar\Calendar;

class CalendarVariableOverride extends \Solspace\Calendar\Variables\CalendarVariable
{
    public function calendars(array $attributes = null): array
    {
        return Calendar::getInstance()->calendars->getAllAllowedCalendars();
    }
}