Limit email template access by sender and receiver role

[asmecher]

It's currently possible to create new email templates for mailables in a way that helps editors create their own email-based workflows. However, all mailables are available to all users when selecting a template, which can lead to inappropriate choices.

From e.g. Settings > Workflow > Emails > Add and edit templates > Discussion (Copyediting):

When an assigned Copyeditor goes to create a new discussion in the Copyediting stage, their Choose a predefined message to use dropdown includes Request Copyedit, which is inappropriate.

To resolve this, we should add support for mailables to be designated as appropriate for certain user groups, so that when a user sees a list of possible email templates, they are only given a list that's relevant or appropriate to them. It should be possible to designate user groups when creating/editing an email template within a mailable. This should only be available on certain mailables, as not all will be related to submission workflow.

Update 2024-10-25: Specification

(from @ewhanson)

Initial steps should be to identify which roles should have access to which mailable templates as well as identifying all mailables across all applications and first-party plugins (if any). From an initial assessment of the feature, it doesn't seem like any new UI elements/pages will be necessary, but an additional todo for that work should be added if it's deemed necessary. Any mailables that roles do not have access to should not show up when creating new templates.

Note: Each todo below should be tracked as separate issues. This issue should only be closed once this work package has been finished entirely.

TODOs

• Identify which sender/receiver roles should have access to which mailables
• Implement role check for mailables #10571
• Investigate what extension support is required (i.e. for existing plugins, mailables added via plugins that don't have roles assigned, etc.) #10649
• Provide documentation for pkp/pkp-lib#10403 feature (changes for release notebook, for docs hub, plugin guide, etc.) #10650

[ewhanson]

Hey @taslangraham, I've also assigned the issue for this work package to you. Have a look at the specification and todos above and let me know what you think. We can talk about any specific issues or questions you see in our one-on-one call on Monday.

[taslangraham]

@asmecher

Currently, each Mailable class has two properties: fromRoleIds and toRoleIds. These arrays hold the Role IDs of the groups designated to send and receive each Mailable. These properties could be used to control which templates are accessible and visible to a user.

However, in the issue, you mentioned that

It should be possible to designate user groups when creating/editing an email template within a Mailable.

Given that each Mailable can be restricted to specific groups, is it a case where we should also allow individual templates of a Mailable to be further limited to a subset of these allowed groups?

For example, if a Mailable is accessible to more than one role, should an individual template of this Mailable be configurable to allow access only to a single role?

[asmecher]

Yes, individual templates should be assignable to sender roles. Think of a discussion template; if managers want to use that to orchestrate a workflow between author and editor, there will be a mix of templates each will use to compose messages. It will be confusing to authors if they see editor templates available for their use.

[asmecher]

Some clarification and a mea culpa for the ambiguous language in the initial filing: The user working in settings should be able to designate which user groups (not role IDs) email templates can be sent by and sent to.