[6.x] Forms 2: Permissions

[duncanmcclean]

This pull request reworks form permissions as part of Forms 2.

New permissions

The Forms permission group now looks like this:

• Configure forms
• Edit forms
  • Create forms
  • Delete forms
• View submissions
  • Delete submissions
• Edit [form] form
• View [form] submissions
  • Delete [form] submissions

Configure forms remains the "super permission" for forms — users with it can do anything form related.

Edit forms grants access to everything about every form (fields, logic, connect, configure), except submissions. Edit [form] form is the per-form equivalent.

View submissions grants read-only access to submissions across all forms, including exporting. Deleting them is behind the Delete submissions child permission. The per-form equivalents behave the same way, scoped to a single form.

Superseding permissions

Since the global permissions take precedence over their per-form equivalents, it doesn't make sense to show both in the roles UI. To solve this, permissions may now declare a permission that supersedes them:

$this->permission('edit {form} form')->supersededBy('edit forms');

When the superseding permission is checked in the roles UI, the superseded permissions are hidden. Unchecking it brings them back, with their checked state intact.

Configure form fields

The configure form fields permission has been deprecated and is no longer registered, so it won't show in the roles UI. However, it's still supported: users with it may access the form builder and logic pages, but nothing else. These are the equivalent pages now that forms don't have blueprints.

It also no longer grants access to the blueprints area of the Control Panel.

Control Panel

• The form section tabs (Edit/Logic/Connect/Results/Configure) only show when the user has the relevant ability. When only one page is accessible, the tabs are hidden entirely.
• Clicking a form on the listing takes the user to the form builder or the submissions listing, depending on their permissions and how many submissions exist.
• The submissions column and badges are hidden on the forms listing when the user can't view any submissions.