Admin buttons added via app.yml require admin credentials to see, buttons added via getGlobalButton() method don't

[agilbert]

I had a project that needed some custom admin buttons, so I put this in my app.yml:

    extra_admin_buttons:
      users:
        label: Users
        action: aUserAdmin/index
        class: a-users
      reorganize:
        label: Reorganize
        action: a/reorganize
        class: a-reorganize
      faculty:
        label: Faculty
        action: faculty/index
        class: a-users
      courses:
        label: Courses
        action: course/index
        class: a-courses

This worked as expected when I logged in as a user with the admin credential. But I needed to be able to see the buttons when logged in as an editor.

I was able to make that work by going back to the hard way:

<?php

class frontendConfiguration extends sfApplicationConfiguration
{
  public function configure()
  {
    $this->dispatcher->connect('a.getGlobalButtons', array('frontendConfiguration', 'getGlobalButtons'));
  }
  
  static public function getGlobalButtons()
  {
    aTools::addGlobalButtons(array(
      new aGlobalButton('faculty', 'Faculty', 'faculty/index', 'a-users'),
      new aGlobalButton('course', 'Courses', 'course/index', 'a-courses')
    ));
  }
}

Apparently buttons added in this way don't care about what the user's credentials are. If the user is logged in and can see the button bar, they will see anything added with the getGlobalButtons() method.

Not sure which of these methods is at fault here, but the fact that it's not consistent says to me that either there is a bug somewhere or something hasn't been appropriately considered.

[tboutell]

Just looked into this.

addGlobalButtons is meant to be called only when you're satisfied that it *should* be called, i.e. the right person is logged in. Call it as appropriate, in other words.

extra_admin_buttons, as its name is meant to suggest, is a cheap way to add extra buttons for admins only.

Looks like it's behaving as intended. You can get the behavior you want by using addGlobalButtons and not calling for a particular button if you don't like who's logged in.

[agilbert]

Makes sense, I guess. Should we be thinking about adding an extra_editor_buttons option then?

[tboutell]

Sounds like a good idea. extra_editor_buttons would load whenever aTools::isPotentialEditor is true.