new: [individual] editing enabled for org admins

- requires that a user exist for the given individual

src/Controller/Component/ACLComponent.php

@@ -87,7 +87,7 @@ class ACLComponent extends Component
         'Individuals' => [
             'add' => ['perm_admin'],
             'delete' => ['perm_admin'],
-            'edit' => ['perm_admin'],
+            'edit' => ['perm_admin', 'perm_org_admin'],
             'filtering' => ['*'],
             'index' => ['*'],
             'tag' => ['perm_tagger'],

src/Controller/IndividualsController.php

@@ -20,6 +20,8 @@ class IndividualsController extends AppController
 
     public function index()
     {
+        $currentUser = $this->ACL->getUser();
+        $orgAdmin = !$currentUser['role']['perm_admin'] && $currentUser['role']['perm_org_admin'];
         $this->CRUD->index([
             'filters' => $this->filterFields,
             'quickFilters' => $this->quickFilterFields,
@@ -31,6 +33,11 @@ class IndividualsController extends AppController
         if (!empty($responsePayload)) {
             return $responsePayload;
         }
+        $editableIds = null;
+        if ($orgAdmin) {
+            $editableIds = $this->Individuals->getValidIndividualsToEdit($currentUser);
+        }
+        $this->set('editableIds', $editableIds);
         $this->set('alignmentScope', 'individuals');
     }
 
@@ -59,6 +66,14 @@ class IndividualsController extends AppController
 
     public function edit($id)
     {
+        $currentUser = $this->ACL->getUser();
+        $validIndividualIds = [];
+        if ($currentUser['role']['perm_admin']) {
+            $validIndividualIds = $this->Individuals->getValidIndividualsToEdit($currentUser);
+            if (!isset($validIndividualIds[$id])) {
+                throw new NotFoundException(__('Invalid individual.'));
+            }
+        }
         $this->CRUD->edit($id);
         $responsePayload = $this->CRUD->getResponsePayload();
         if (!empty($responsePayload)) {

src/Model/Table/IndividualsTable.php

@@ -110,4 +110,15 @@ class IndividualsTable extends AppTable
         }
         return $query->group(['Individuals.id', 'Individuals.uuid']);
     }
+
+    public function getValidIndividualsToEdit(object $currentUser): array
+    {
+        $validIndividualIds = $this->Users->find('list')->select(['individual_id'])->where(
+            [
+                'organisation_id' => $currentUser['organisation_id'],
+                'disabled' => 0
+            ]
+        )->all()->toArray();
+        return array_keys($validIndividualIds);
+    }
 }

templates/Individuals/add.php

@@ -24,7 +24,7 @@
                 array(
                     'field' => 'tag_list',
                     'type' => 'tags',
-                    'requirements' => $this->request->getParam('action') === 'edit'
+                    'requirements' => ($this->request->getParam('action') === 'edit' && $loggedUser['role']['perm_admin'])
                 ),
             ),
             'submit' => array(

templates/Individuals/index.php

@@ -81,12 +81,25 @@ echo $this->element('genericElements/IndexTable/index_table', [
             [
                 'open_modal' => '/individuals/edit/[onclick_params_data_path]',
                 'modal_params_data_path' => 'id',
-                'icon' => 'edit'
+                'icon' => 'edit',
+                'complex_requirement' => [
+                    'function' => function ($row, $options) use ($loggedUser, $editableIds) {
+                        if ($loggedUser['role']['perm_admin'] || ($editableIds && in_array($row['id'], $editableIds))) {
+                            return true;
+                        }
+                        return false;
+                    }
+                ]
             ],
             [
                 'open_modal' => '/individuals/delete/[onclick_params_data_path]',
                 'modal_params_data_path' => 'id',
-                'icon' => 'trash'
+                'icon' => 'trash',
+                'complex_requirement' => [
+                    'function' => function ($row, $options) use ($loggedUser) {
+                        return (bool)$loggedUser['role']['perm_admin'];
+                    }
+                ]
             ],
         ]
     ]