Changeset 2145245

Timestamp:

08/26/2019 12:56:51 AM (6 years ago)

Author:

Will Brownsberger

Message:

version 4.5 work in progress

Location:

wp-issues-crm/trunk

Files:

• css/dashboard.css (modified) (2 diffs)
• css/email.css (modified) (4 diffs)
• css/main.css (modified) (1 diff)
• js/constituent.js (modified) (1 diff)
• js/dashboard.js (modified) (2 diffs)
• js/email-inbox.js (modified) (6 diffs)
• js/email-message.js (modified) (15 diffs)
• js/email-process.js (modified) (3 diffs)
• js/email-send.js (modified) (1 diff)
• js/issue.js (modified) (1 diff)
• js/manage-storage.js (modified) (1 diff)
• php/admin/class-wic-admin-access.php (added)
• php/admin/class-wic-admin-navigation.php (modified) (21 diffs)
• php/admin/class-wic-admin-settings.php (modified) (7 diffs)
• php/admin/class-wic-admin-setup.php (modified) (1 diff)
• php/db/class-wic-db-email-message-object.php (modified) (1 diff)
• php/entity/class-wic-entity-activity.php (modified) (1 diff)
• php/entity/class-wic-entity-dashboard.php (modified) (4 diffs)
• php/entity/class-wic-entity-email-account.php (modified) (2 diffs)
• php/entity/class-wic-entity-email-block.php (modified) (1 diff)
• php/entity/class-wic-entity-email-inbox-parse.php (modified) (2 diffs)
• php/entity/class-wic-entity-email-inbox.php (modified) (21 diffs)
• php/entity/class-wic-entity-email-message.php (modified) (5 diffs)
• php/entity/class-wic-entity-email-process.php (modified) (2 diffs)
• php/entity/class-wic-entity-email-send.php (modified) (1 diff)
• php/form/class-wic-form-email-inbox.php (modified) (4 diffs)
• php/list/class-wic-list-activity.php (modified) (1 diff)
• php/list/class-wic-list-constituent.php (modified) (1 diff)
• php/list/class-wic-list-parent.php (modified) (1 diff)
• sql/wic_structures.sql (modified) (2 diffs)
• wp-issues-crm.php (modified) (1 diff)

wp-issues-crm/trunk/css/dashboard.css

@@ -60 +60 @@
 }
 
+
 /* used in email too */
 button.wic-dashboard-title {
@@ -190 +191 @@
     font-weight: 250;
     color: #999;
+}
+#wic-inner-dashboard-dashboard_overview {
+    padding: 0 10px;
+}
+
+table#wic-work-flow-status {
+    width: 100%;
+    color: #777;
+    border-top: 1px solid #ddd;
+    border-bottom: 1px solid #ddd;
+    padding: 10px;
+    line-height: 2.0em;
+}
+
+table#wic-work-flow-status tr:nth-child(odd){ 
+    background: #f0f0f0;
+}
+table#wic-work-flow-status tr:nth-child(even){
+    background: #fefefe;
+}
+
+#wic-work-flow-status td.wic-staff-overdue-assignment {
+    font-weight: 400;
+    color: #b66;
+}
+
+#wic-work-flow-status td:nth-child(1),
+#wic-work-flow-status th:nth-child(1) {
+    width: 23%;
+}
+
+#wic-work-flow-status th {
+    font-size: 1.0em;
+}
+#wic-work-flow-status td {
+    font-size: 1.2em;
+    border-top: 1px solid #ddd;
+}
+
+.wic-email-dashboard-date {
+    font-style: italic;
+    font-weight: 300;
+}
+
+#wic-work-flow-status td,
+#wic-work-flow-status th {
+    width: 11%;
+    padding: 3px;
+    text-align: center;
+}
+
+#wic-work-flow-status tr th:nth-child(1),
+#wic-work-flow-status tr td:nth-child(1) {
+    text-align: left;
+    padding-left: 20px;
 }
 

wp-issues-crm/trunk/css/email.css

@@ -257 +257 @@
 }
 
+#wic-email-inbox-header #wic-filter-assigned-button,
 #wic-email-inbox-header .wic-form-button.page-link  {
     margin: 0 10px 0 0;
@@ -266 +267 @@
     vertical-align: middle;
     white-space:nowrap;
-    width: calc(98.88888% - 6.22222% - 480px);
+    width: calc(98.88888% - 6.22222% - 510px);
 }
 
@@ -333 +334 @@
     font-size: 1.2em;
     display: inline-block;
-    width: calc(90% - 256px);
+    width: calc(90% - 296px);
     overflow-x: hidden;
     vertical-align: middle;
@@ -679 +680 @@
     font-weight: 700;
 }
+
+.subject-line-item.subject.inbox-assigned-staff {
+    font-weight: 700;
+    color: green;
+}
+
+
+
 
 .subject-line-item.count {

wp-issues-crm/trunk/css/main.css

@@ -130 +130 @@
 }
 
+#wic-unassigned-message {
+    margin: 20px 0.88888%;
+}
+
+#wic-unassigned-message h3 {
+    color: red;
+}
 /* body of form -- field group areas */
 #wic-form-body {

wp-issues-crm/trunk/js/constituent.js

@@ -117 +117 @@
             wpIssuesCRM.loadActivityArea( true );
             $("#wic-constituent-delete-button").tooltip( {show: false, hide: false });
+            
+            if ( !wpIssuesCRMSettings.canViewOthersAssigned ) {
+                $( "#wic-inner-field-group-case input").prop("disabled", true)
+            }
+            
         }
     }

wp-issues-crm/trunk/js/dashboard.js

@@ -8 +8 @@
 
     $( "#wp-issues-crm" ).on ( "initializeWICForm", function () {
-        if ( $ ( "#dashboard_activity" )[0] ) {
+        if ( $ ( "#dashboard_overview" )[0] ) {
             wpIssuesCRM.loadDashboard();
         }
@@ -14 +14 @@
 
     // initialize directly (normally ajax triggered) in case access by get
-    if ( $ ( "#dashboard_activity" )[0] ) {
+    if ( $ ( "#dashboard_overview" )[0] ) {
         wpIssuesCRM.loadDashboard();
     }

wp-issues-crm/trunk/js/email-inbox.js

@@ -57 +57 @@
         selectedPage = 'inbox';
         selectedTab = '';
+        selectedStaff = 0;
     // define this inbox view variable as global for access in restoring undo
     wpIssuesCRM.inboxAscending = {
@@ -165 +166 @@
         // uncheck master checkbox for inbox
         $( "#inbox-master-checkbox" ).prop("checked", false );
-        /* on submit, if requests pending, notify user . . . intending to obsolesce this notice -- more annoying than helpful
-            if ( wpIssuesCRM.pendingMailRequests && 'inbox' == selectedPage ) {
-                wpIssuesCRM.alert ( 
-                    '<p>Inbox initiated reload before all action requests had completed processing -- may not be up to date.  In case of doubt, refresh in a few seconds.</p>'
-                )
-            }
-        */
         // set up loading UI
         $( ".inbox-mode-button, .page-link" ).prop( "disabled", true ); // prevent double submits
@@ -186 +180 @@
             page:       nextPage[selectedPage],
             filter:     $( "#wic-email-inbox #subject" ).val(),
-            tab:        selectedTab
+            tab:        selectedTab,
+            staff:      selectedStaff
         }
         wpIssuesCRM.ajaxPost( 'email_inbox', 'load_' + selectedPage,  0, inboxParms,  function( response ) {
@@ -239 +234 @@
                 }
             }
+            // enable or disable assignment selection button
+            if ( !['CATEGORY_ASSIGNED', 'CATEGORY_READY'].indexOf(inboxParms.tab) > -1 || !wpIssuesCRMSettings.canViewOthersAssigned ){
+                $( '#wic-filter-assigned-button' ).prop( 'disabled',false ).removeClass('ui-state-disabled');
+            } else {
+                $( '#wic-filter-assigned-button' ).prop( 'disabled',true ).addClass('ui-state-disabled');
+            }
+
             // alert if polling has been halted due to connection failures
             if ( response.connection ) {
@@ -400 +402 @@
         })
 
+        .on( "click", "#wic-filter-assigned-button", function() {
+            wpIssuesCRM.doFilterAssignmentPopup();
+        })
+
+
         .on( "click", ".page-link", function() {
             if ( ! $( this ).hasClass( 'ui-state-disabled' ) ) {
@@ -471 +478 @@
 
 
+    // popup to select assigned person to filter by
+    wpIssuesCRM.doFilterAssignmentPopup = function() {
+        var popupWidth = 480;
+        var popupContent = '<div title="Select Assigned Staff for Message Display"><div id = "staff_filter_assignment_popup">' + 
+            $( "#hidden-staff-assignment-control" ).html() + 
+            '<p class="staff_assignment_popup-legend">Selection applies only when viewing Assigned or Ready tab.</p>' +
+            '</div></div>'; 
+        dialog              = $.parseHTML( popupContent );
+        wpIssuesCRM.filterAssignedPopupObject = $( dialog );
+        wpIssuesCRM.filterAssignedPopupObject.dialog({
+            appendTo: "#wp-issues-crm",
+            closeOnEscape: true,
+            close: function ( event, ui ) {
+                wpIssuesCRM.filterAssignedPopupObject.remove(); 
+                wpIssuesCRM.filterAssignedPopupObject = false;
+                },
+            width: popupWidth,
+            height: 480,
+            position: { my: "right top", at: "right top", of: "#wic-filter-assigned-button" },  
+            show: { effect: "fadeIn", duration: 200 },
+            buttons: [],
+            modal: true,
+        });
+        selectStaffButton = $( "#staff_filter_assignment_popup #case_assigned" );
+        wpIssuesCRM.setVal( selectStaffButton[0],selectedStaff, '' ); // empty string is ignored provided staff # exists
+        
+        selectStaffButton.on( "change", function( event, ui ) {
+            selectedStaff = selectStaffButton.val();
+            nextPage[selectedPage] = 0;
+            wpIssuesCRM.loadSelectedPage(); 
+            wpIssuesCRM.filterAssignedPopupObject.fadeOut( 200, 'swing', function(){ wpIssuesCRM.filterAssignedPopupObject.remove(); })     
+        }); 
+    };
+
+
 
 }( window.wpIssuesCRM = window.wpIssuesCRM || {}, jQuery )); // end  namespace enclosure    

wp-issues-crm/trunk/js/email-message.js

@@ -14 +14 @@
     // assigned staff
     wpIssuesCRM.assignedStaff = false;
-    wpIssuesCRM.preAssignedStaff = false; // assignment is on an existing constituent record
     // parse details popup info
     var parseDetails = false;
@@ -24 +23 @@
     // cache to display transition line for reply preview image
     wpIssuesCRM.replyTransitionLine = '';
+    // message is a final draft reply from inbox
+    wpIssuesCRM.replyFinal = 0;
+
     /*
     *
@@ -48 +50 @@
             forced_root_block : 'div',
             init_instance_callback: function (editor) {
-                editor.on('change keyup', function (e) {
+                editor.on('change keyup paste', function (e) {
                     editor.save();
                     editorChange();
@@ -84 +86 @@
             subjectLineMoveEventCache = event;
             if ( wpIssuesCRM.formDirty ) {
-                wpIssuesCRM.confirm ( 
-                    subjectLineMove,
-                    false,
-                    '<p>Change subject without sending composed message?</p>' 
-                 )
-            } else {
-                subjectLineMove();
-            }
+                handleTemplateChange();
+            } 
+            subjectLineMove();
         })
         .on( "click", ".wic-form-button.scroll-button", wpIssuesCRM.handleScrollButton )
         .on ( "click", "#wic-email-close-button", function(){
             if ( wpIssuesCRM.formDirty ) {
-                wpIssuesCRM.confirm ( 
-                    wpIssuesCRM.closeMessageDetails,
-                    false,
-                    '<p>Close without sending composed message?</p>' 
-                 )
-            } else {
-                wpIssuesCRM.closeMessageDetails();
-            }
+                handleTemplateChange();
+            } 
+            wpIssuesCRM.closeMessageDetails();
         })
         //  info request handlers
-        .on( "click", "#assigned-case-popup-button", wpIssuesCRM.handleAssignedCasePopupClick )
+        .on( "click", "#assigned-case-popup-button", wpIssuesCRM.handleAssignmentPopupClick )   
         .on( "click", "#parse-popup-button", wpIssuesCRM.doParseDetailsPopup ) 
         .on( "click", "#view-issue-button", wpIssuesCRM.doIssuePeekPopup )
         // change listeners ( in addition to tinymce form dirty change)
         .on ( "change", "#wic-message-sender-constituent  #constituent_id", wpIssuesCRM.saveConstituentToInboxImage )
-        .on ( "change", "#wic-inbox-work-area #issue", synchIssueFields )
-        .on ( "change", "#wic-inbox-work-area #pro_con", setLoadButtonColor ) 
+        .on ( "change", "#wic-inbox-work-area #issue", handleIssueChange )
+        .on ( "change", "#wic-inbox-work-area #pro_con", handleProConChange ) 
         // initialize action request handlers
         // processEmail distinguishes the trigger buttons
@@ -126 +118 @@
             setSaveButtonColor()
             // 4.3.0 handle dirty
-            wpIssuesCRM.formDirty = true;
+            if ( ! wpIssuesCRM.formDirty ) {
+                wpIssuesCRM.formDirty = true;
+                // set timer for saving of template
+                setTimeout( handleTemplateChange, 5000 );
+            }
         });
     }
@@ -222 +218 @@
         // get the message
         wpIssuesCRM.ajaxPost( 'email_message', 'load_message_detail',  currentUID(), data,  function( response ) {
+            /*
+            * set approval button appearance
+            */
+            setThumbsUpDown( response.reply_is_final );
             /*
             * set up the title for the subject line group of message
@@ -248 +248 @@
             // save assigned staff -- setting to 0 if unassigned
             wpIssuesCRM.assignedStaff = response.assigned_staff;
-            wpIssuesCRM.preAssignedStaff = response.assigned_staff > 0;
             chooseStaffButtonColor();
+            // save final draft status
+            wpIssuesCRM.replyFinal = response.reply_is_final;
             // update the scroll positions
             $( "#wic-message-scroll-position" ).html( wpIssuesCRM.currentMessageVars.activeMessage + 1 )
@@ -315 +316 @@
     *
     **********/
-
-    wpIssuesCRM.handleAssignedCasePopupClick = function () {
+    wpIssuesCRM.handleAssignmentPopupClick = function () {
         if ( 1 == wpIssuesCRM.currentMessageVars.countMessages ) {
-            wpIssuesCRM.doAssignedCasePopup();
+            wpIssuesCRM.doAssignmentPopup();
         } else {
             wpIssuesCRM.alert ( 
-                "<p>Case assignment only available for single messages.</p><p>Instead, you could assign the whole issue to a staff member " +
+                "<p>Assignment only available for single messages.</p><p>Instead, you could assign the whole issue to a staff member " +
                  "(update the issue) OR just switch the inbox out of grouped mode (<b><em>1</em></b>).</p>" );
         }
     }
-
     // informational popup 
-    wpIssuesCRM.doAssignedCasePopup = function() {
+    wpIssuesCRM.doAssignmentPopup = function() {
         var popupWidth = 480;
-        var popupContent = '<div title="Assign Staff to Message Sender"><div id = "staff_assignment_popup">' + 
+        var popupContent = '<div title="Assign Staff to Handle Message"><div id = "staff_assignment_popup">' + 
             $( "#hidden-staff-assignment-control" ).html() + 
-            ( wpIssuesCRM.preAssignedStaff ?
-            '<p class="staff_assignment_popup-legend">Cannot reassign active case staff from inbox -- reassign from constituent update.</p>' :
-            '<p class="staff_assignment_popup-legend">Constituent case will be assigned when you record or reply and, if you reply, assigned staff will be copied.</p>' ) +
+            '<p class="staff_assignment_popup-legend">Email will be assigned for drafting of reply to selected staff.</p>' +
             '</div></div>'; 
         dialog              = $.parseHTML( popupContent );
@@ -356 +353 @@
         selectStaffButton.on( "change", function( event, ui ) {
             wpIssuesCRM.assignedStaff = selectStaffButton.val();
+            wpIssuesCRM.saveValueToInboxImage( 'staff', wpIssuesCRM.assignedStaff );
             wpIssuesCRM.assignedCasePopupObject.fadeOut( 500, 'swing', function(){ wpIssuesCRM.assignedCasePopupObject.remove(); })     
             chooseStaffButtonColor();
         }); 
-        if ( wpIssuesCRM.preAssignedStaff ) {
-            selectStaffButton.next().prop( "disabled", true );
-        } else {
-            selectStaffButton.next().prop( "disabled", false );
-        }
     };
 
@@ -531 +524 @@
         });
         wpIssuesCRM.showLoader( 'message_view' );
-        wpIssuesCRM.ajaxPost( 'email_message', 'load_full_message',  selectedPage, ID,  function( response ) {      
+        wpIssuesCRM.ajaxPost( 'email_message', 'load_full_message',  ID, selectedPage,  function( response ) {      
             $( "#message_view" ).html( 
                 response.recipients_display_line + 
@@ -659 +652 @@
     *
     */
+
+    /* 
+    * saveValueToInboxImage is used  to pass values to 
+    * inbox_defined_staff,
+    * inbox_defined_issue,
+    * inbox_defined_pro_con,
+    * inbox_defined_reply_text,
+    * inbox_defined_reply_is_final
+    *
+    * pass field to update as "staff" or "issue", etc.
+    *
+    */
+    wpIssuesCRM.saveValueToInboxImage = function( field_to_update, field_value ){
+        // no reason to disable processing buttons
+        
+        // set up update values
+        var data = {
+            field_to_update: field_to_update,
+            field_value: field_value,
+            full_folder_string: wpIssuesCRM.lastLoadParms.folder
+        };
+        // do the update
+        wpIssuesCRM.ajaxPost( 'email_message', 'quick_update_inbox_defined_item', currentUID(), data,  function( response ) {
+        });
+    }
+    
+    
+    
+    
     wpIssuesCRM.saveConstituentToInboxImage = function(){
         // disable processing buttons
         processingButtons = $( "#wic-email-record-button, #wic-email-record-reply-button, #wic-inbox-sweep-button" );
+        processingButtons.prop("disabled", true );
+
         // set up update values
         var data = {
@@ -669 +693 @@
         // do the update
         wpIssuesCRM.ajaxPost( 'email_message', 'quick_update_constituent_id', currentUID(), data,  function( response ) {
-            // save assigned_staff on return
-            wpIssuesCRM.assignedStaff = response.case_assigned;
-            wpIssuesCRM.preAssignedStaff = response.case_assigned > 0;
+
             // if in multi line mode, automatically update selected constituent_name in displayed address (since not changeable directly by user)
             if ( response.constituent_name && 1 < wpIssuesCRM.currentMessageVars.countMessages ) {
@@ -689 +711 @@
             color = '#ddd'
         } else if ( wpIssuesCRM.assignedStaff > 0 ) {
-            if ( wpIssuesCRM.preAssignedStaff ) {
-                color = "#333"
-            } else {
-                color = 'green'
-            }
+            color = 'green'
         } else {
             color = '#999';
@@ -701 +719 @@
 
     /*
+    *
+    * these two functions allow split of synchIssueFields and setLoadButtonColor from update
+    *
+    */
+    function handleIssueChange() {
+        synchIssueFields();
+        wpIssuesCRM.saveValueToInboxImage ( 'issue',  $( "#wic-inbox-work-area #issue").val() );
+    }
+    
+    function handleProConChange () {
+        setLoadButtonColor();
+        wpIssuesCRM.saveValueToInboxImage ( 'pro_con',  $( "#wic-inbox-work-area #pro_con").val() ); 
+    
+    }
+    /*
+    *
+    * isolated so can be called on timer and on leave 
+    *
+    */
+    function handleTemplateChange() {
+        if ( wpIssuesCRM.formDirty ) {
+            // reset dirty indicator to false before saving so that will start new timer on next keystroke after getContent -- last timer must always run
+            // However, note that risk exists if save is delayed on server side, could queue multiple unnecessary requests.  Accept this risk rather than trying to abort earlier -- prioritize delivering the save
+            wpIssuesCRM.formDirty = false;
+            //proceed to save
+            if ( tinymce.activeEditor ) {
+                wpIssuesCRM.saveValueToInboxImage ( 'reply_text', tinymce.activeEditor.getContent() );
+            }
+        }
+    }
+    /*
     * update current issue links
     *
     * fired on change issue
-    * also fired on blur (to get to no issue assigned value), so can fire an extra time on the standard select/blur sequence
+    * also fired on scroll message to set up issue link
     *
     * slight risk that fast user on slow system could select and then to the peek popup before this function returns, but
@@ -729 +778 @@
         }
     }
-    
+    /*
+    *
+    * handle approval button
+    *
+    *
+    */
+    // set to opposite of status -- note that status comes through as a string value
+    function setThumbsUpDown ( status ) {
+        if ( '1' == status ) {
+            $( "#wic-email-approve-button span").addClass('dashicons-thumbs-down');
+            $( "#wic-email-approve-button span").removeClass('dashicons-thumbs-up');
+            jQuery (  "#wic-email-approve-button" ).attr("title","Reject draft");
+        } else {
+            $( "#wic-email-approve-button span").addClass('dashicons-thumbs-up');
+            $( "#wic-email-approve-button span").removeClass('dashicons-thumbs-down');      
+            jQuery (  "#wic-email-approve-button" ).attr("title","Submit draft");
+        }
+    }
+    //
     /*
     *

wp-issues-crm/trunk/js/email-process.js

@@ -41 +41 @@
             eventVal = $( event.target ).closest( ".trigger-email-process-button" ).val();
         }       
+
+        // handle approval processing with different ui
+        if ( 'approve' == eventVal ) {
+            toggleApproval();
+            return;
+        }
+
+        if( !wpIssuesCRMSettings.canSendEmail) {
+            wpIssuesCRM.alert( 'Your user role can only submit or unsubmit emails.  Ask your supervisor for to upgrade your role so that you can send and take other actions.')
+            return;
+        }
+        
         // handle sweep processing with different ui
         if ( 'sweep' == eventVal ) {
@@ -46 +58 @@
             return;
         }
-        // not sweeping, so cache the active line object and set up its uids for use in the next undo link
+
+        // not sweeping or approving, so cache the active line object and set up its uids for use in the next undo link
         lastDeleted     = wpIssuesCRM.activeLine.clone();
         lastDeletedUids = wpIssuesCRM.activeLine.find( ".UIDs").text();
@@ -425 +438 @@
     }
 
+    // non-process function to toggle approval status
+    toggleApproval = function() {
+        // alert regarding multi-message subjects
+        if ( wpIssuesCRM.currentMessageVars.countMessages > 1 ) {
+            wpIssuesCRM.alert (
+                        '<p>Cannot take approval or disapproval action when handling more than one message in a subject line.</p>' +
+                        '<p>Switch the inbox out of grouped mode to manage approval status (<b><em>1</em></b>).</p>'        
+            )
+        } else {
+            // toggle approval status 
+            newStatus = $( "#wic-email-approve-button span").hasClass('dashicons-thumbs-down') ? 0 : 1;
+            wpIssuesCRM.saveValueToInboxImage ( 'reply_is_final',  newStatus );
+            // move to next line -- toggled status should move message to new tab
+            var nextLine = wpIssuesCRM.activeLine.nextAll("li:not(.item-sending)")[0];
+            wpIssuesCRM.activeLine.remove();
+            wpIssuesCRM.jumpToSubjectLine( nextLine, 250 ); 
+        }       
+
+    
+    }
 
     // bulk action on delete or block from inbox level

wp-issues-crm/trunk/js/email-send.js

@@ -29 +29 @@
 
     wpIssuesCRM.handleComposeButton = function ( event ) { 
+    
+        if( !wpIssuesCRMSettings.canSendEmail) {
+            wpIssuesCRM.alert( 'Your user role can only submit or unsubmit emails for approval.  Ask your supervisor for to upgrade your role so that you can send and take other actions.')
+            return;
+        }   
+    
         // handle click on span within button  
         var eventVal = $( event.target ).val();

wp-issues-crm/trunk/js/issue.js

@@ -50 +50 @@
             wpIssuesCRM.loadActivityArea( true );
         }
+
+        if ( !wpIssuesCRMSettings.canViewOthersAssigned ) {
+            $( "#wic-inner-field-group-issue_management input").prop("disabled", true)
+        }
+
+
     }
 

wp-issues-crm/trunk/js/manage-storage.js

@@ -59 +59 @@
                     } else { 
                         // require confirmation to go further
-                        wpIssuesCRM.confirm (
+                        wpIssuesCRM.confirm ( 
                             function () {
                                 $( "#manage_storage_button" ).text( "Purging . . ." );

wp-issues-crm/trunk/php/admin/class-wic-admin-navigation.php

@@ -11 +11 @@
     /* 
     *
-    *   All user/form requests to the plugin are routed through this navigation class, which is light -- does no database access (except dictionary, needed on one non-wic page -- for post metabox in post edit)
+    *   All user/form requests to the plugin are routed through this navigation class
     *       GET Requests 
     *           Wordpress menu and any page request get screened by wordpress at security levels defined in menu_setup
     *               Page gets with additional parameters further controlled as to what parameters OK through do_page referencing $nav_array
-    *           If has attachment ID will get served off admin_init to emit_stored_file before do_page -- check_security checks capability and nonce
-    *
-    *       All other requests run through check_security for both capability and nonce checking        
+    *           If page request includes attachment ID, it will get served off admin_init to emit_stored_file before do_page -- check_security checks capability and nonce
+    *
+    *       AJAX Requests to Entities  run through check_security for both capability and nonce checking        
     *           AJAX Form Posts -- all forms are submitted via AJAX to lower Wordpress Admin overhead
-    *           AJAX Requests -- specific actions below the form level
-    *           Download Button submits
+    *           AJAX Requests -- specific actions below the entity level
+    *           Only Entity Classes/methods are invoked by the AJAX endpoints -- check_security covers all entities, 
+    *
+    *       Special requests -- limited functions -- check security and nonce   
+    *           Download Button submits(2)
     *           Gmail API 
+    *           Upload requests (3)
     *
     *   THIS IS THE ONLY ROUTE TO EXECUTE PLUG-IN CODE EXCEPT FOR:
     *       (0) DB setup (invoked in wp-issues-crm.php ) 
-    *       (1) Cron tasks (which route mail synch/parse/deliver through WP_Entity_Email_Account )
+    *       (1) Cron tasks for email and geocoding, protected by cron keys in config
     *       (2) Interface transactions (which accept and sanitize external form records for constituents and activities)
     *       (3) The metabox for post set up in WIC_Admin_Setup and other minor functions invoked wp-issues-crm.php
     *       (4) ANY OTHER WORDPRESS PLUGIN THAT CHOSE TO EXECUTE PLUG-IN CODE!
     *
+    *   Since 4.5, WIC_Admin_Access contains check_security which now also enforces access limits to assigned records -- all accesses hit this (ex the above exceptions)
+    *           Client side access controls are all spoofable; so test all ajax calls here on the server side, although various buttons are hidden or disabled to avoid annoyance of failed access
+    *               Ultimately dependent on Wordpress login security
+    *           Default in all tests is to disallow without administrator access.
+    *       
     */
 
@@ -84 +93 @@
 
     /*
-    *   All $_GET processing is mediated through Wordpress -- the menu and submenu page structure (exception gets for attachments)
+    *   All $_GET processing is mediated through Wordpress -- the menu and submenu page structure (partial exceptions gets for attachments)
     *   Two main functions -- menu_setup and do_page control this flow. 
     *       $nav_array is used in both and limits valid GET requests (otherwise, nav logic could attempt route to arbitrary class functions)    
     *           keys are pages as in add_menu_page or add_sub_menu_page; values are parameters governing the page display
-    *           array also used for reverse look up for security level on AJAX requests 
+    *   
     */
     private $nav_array = array (
@@ -95 +104 @@
             'default'   =>  array ( 'dashboard', 'dashboard' ),// default entity/action to invoke if $_GET does not contain permitted entity and actions
             'permitted' =>  array (                             // permissible entity/action pairs for the page on a GET request
-                                array ( 'dashboard',        'my_cases'      ),
-                                array ( 'dashboard',        'my_issues'     ),
-                                array ( 'dashboard',        'search_log'    ),
                                 array ( 'constituent',      'id_search'     ),
                                 array ( 'constituent',      'new_blank_form'),
-                                array ( 'constituent',      'new_form'      ),
                                 array ( 'email_inbox',      'new_blank_form'),
                                 array ( 'issue',            'id_search'     ),
                                 array ( 'issue',            'new_blank_form'),
-                                array ( 'issue',            'new_form'      ),
                                 array ( 'search_log',       'id_search'     ),
                                 array ( 'search_log',       'id_search_to_form' ),
                                 array ( 'advanced_search',  'new_blank_form' ),
-                                array ( 'user',             'id_search'     ),
                             ),
             'mobile'    =>  true,                               // works on small screens
@@ -174 +177 @@
             ),
         );
-
+    
+    
+    
+
+    private $unassigned_message = 
+        '<div id="wic-unassigned-message">
+            <h3>You requested a record to which you have not been assigned or a function to which your role does not give you access.</h3>
+            <p>If you need access, consult your supervisor and request that the record be assigned to you or that your role be upgraded to a level that has access to unassigned constituents, issues and messages and/or to more functions.</p>
+            <p>Since Version 4.5 (August 2019), <strong>WP Issues CRM &raquo; Configure &raquo; Security</strong> determines which user roles have access to unassigned constituents and issues.</p>
+        </div>';
     
     // set up menu and submenus with required capability levels defined from $nav_array -- WP is checking security on the page access
@@ -180 +192 @@
             
         $menu_position = '4.19544595294'; // pick arbitrary decimal number to avoid possibility of conflicts
-        $main_security_setting = self::check_required_capability( '' );
+        $main_security_setting = WIC_Admin_Access::check_required_capability( '' );
         // need to run add setting  before add page -- too late to register if try not to do the work until on the page         
         $wic_admin_settings = new WIC_Admin_Settings; 
@@ -204 +216 @@
 
     // format a page from menu ( or direct $_GET in which case, invoke entity/action based on $_GET; if not permitted entity/action pair route to default )
-    public function do_page (){
-    
-        // get page parms from nav_array (page will always be in array since it covers all the pages that access the plugin)    
+    // wordpress is doing the security checking on a GET
+    public function do_page (){ 
+    
+        // get page parms from nav_array (page will always be in array since it defines all the pages that access the plugin)   
         $page   = $_GET['page'];
         $parms  = $this->nav_array[$page];
@@ -228 +241 @@
             // processing allowed get strings or defaults for pages
             if ( 0 < count ( $_GET ) ) { 
+                // if fully defined and OK string for page
                 if ( isset ( $_GET['entity'] ) && isset ( $_GET['action'] ) && isset ( $_GET['id_requested'] )  ) {
-                    // filter allowed get actions
+                    // filter allowed get actions. here is the page security check from $nav_array
                     if ( in_array ( array ( $_GET['entity'] , $_GET['action'] ), $parms['permitted'] ) ) { 
                         $class_short = $_GET['entity'];
                         $action = $_GET['action'];
-                        $args   = array( 'id_requested' => ( 'user' == $class_short ? get_current_user_id() : $_GET['id_requested'] ) );
+                        $id = $_GET['id_requested'];
+                        $args   = array( 'id_requested' => $id ); // removed get path to user
                     }
                 } 
+                // if not fully defined or not OK
                 if ( !isset ( $class_short ) ) {
                     $class_short = $parms['default'][0];
                     $action = $parms['default'][1];
-                    $args   = 'user' == $class_short ? array( 'id_requested' => get_current_user_id() ) : array(); 
+                    $args   = array(); 
+                    $id     = '';
                 }
+                
+                // cosmetics
                 if ( 'wp-issues-crm-main' == $page ) { 
                     $this->show_top_menu ( $class_short, $action );
                 } 
-                // cosmetics
                 $showing_email = '';
                 if ( isset( $_GET['entity'] ) ) {
@@ -251 +269 @@
                     }
                 }
+                
                 // main action
                 echo '<div id="wic-main-form-html-wrapper" class="' . $showing_email . '">';    
                     if ( $class_short ) {  
-                        $class  = 'WIC_Entity_' . $class_short; 
-                        $class_action = new $class ( $action, $args );
+                        if ( WIC_Admin_Access::check_security ( $class_short, $action, $id, '', false ) ) { // false means no nonce to check
+                            $class  = 'WIC_Entity_' . $class_short; 
+                            $class_action = new $class ( $action, $args );
+                        } else {
+                            echo $this->unassigned_message;
+                        }
                     } else {
                         $action[0]::{$action[1]}(); // static function in settings case -- php 7.1{}
@@ -270 +293 @@
         if (preg_match('~MSIE|Internet Explorer~i', $ua) || (strpos($ua, 'Trident/7.0') !== false && strpos($ua, 'rv:11.0') !== false) ) {
             echo '<p><em>It appears you are using Internet Explorer.  Internet Explorer does not support all modern javascript language constructs.
-                WP Issues CRM performs best using Chrome.</em></p>';
+                WP Issues CRM performs best using Chrome or Firefox.</em></p>';
             return;
         }           
-        if ( false === stripos ( $ua, 'chrome' ) ) {
-            echo '<p><em>It appears you are using a browser other than Chrome.  WP Issues CRM performs best using Chrome.</em></p>';
-        }
 
     }
@@ -320 +340 @@
     // a2b (array to button) 
     private function a2b ( $top_menu_button ) {
+    
+        if ( !current_user_can (WIC_Admin_Access::check_required_capability ('view_edit_unassigned') ) ) {
+            if ( in_array ( $top_menu_button[0], array ( 'issue', 'advanced_search', 'upload') ) ) {
+                return false;
+            }
+        }
+    
+    
         $button_args = array (
                 'entity_requested'      =>  $top_menu_button[0],
@@ -335 +363 @@
 
     /*
-    *   AJAX Routing functions
+    *   AJAX Routing functions -- 
     *       FORM
     *       Plain request
     *
+    *   Both are limited to Entity Classes
+    *   Check security requires raised security for admin classes (identified in nav_array)
     */
 
-    public function route_ajax_form() { 
+    public function route_ajax_form() {
     
         $this->dictionary_setup(); 
@@ -347 +377 @@
         $control_array = explode( ',', $_POST['wic_form_button'] );
         
-        // check security and as a byproduct, get requesting page for use in history URL        
+        // define terms     
         $entity = $control_array[0];
-        $requesting_page = $this->check_security ( $entity );
-        if ( false === $requesting_page ) {
-            $requesting_page = 'wp-issues-crm-main';
-        } 
-        
-        $class  = 'WIC_Entity_' . $entity;
         $action = $control_array[1];
         $id_requested = $control_array[2];
+        $class  = 'WIC_Entity_' . $entity;
         $args = array (
             'id_requested'          =>  $id_requested,
         );
 
-        // do the request
+        // check_security and die or do the request
         ob_start();
-        $new_entity = new $class ( $action, $args );
+        if ( WIC_Admin_Access::check_security ( $entity, $action, $id_requested, '' ) ) {
+            $new_entity = new $class ( $action, $args );
+        } else {
+            wp_die( $this->unassigned_message ); // no further state processing -- leave client page unaltered
+        }
         $output = ob_get_clean();
 
@@ -395 +424 @@
         }
         
-        // complete the push state instructions
+        // complete the push state url by adding in requesting page
+        $requesting_page = false;
+        foreach ( $this->nav_array as $page => $parms ) {
+            foreach ( $parms['permitted'] as $permitted ) {
+                if ( $entity == $permitted[0] ) {
+                    $requesting_page = $page;
+                    break(2);
+                }
+            }
+        }
+        if ( false === $requesting_page ) {
+            $requesting_page = 'wp-issues-crm-main';
+        } 
         $response->state = admin_url ( 'admin.php?page=' . $requesting_page . $resource );
-    
+
         // send AJAX response
         wp_die( json_encode ( $response ) );
@@ -403 +444 @@
 
 
-    public function route_ajax () {
+    public function route_ajax () { 
     
         $this->dictionary_setup();
@@ -422 +463 @@
         */  
         $entity = $_POST['entity'];
-        // check security -- dies on failure
-        $this->check_security( $entity );   
-        
-        // respond to request ( response function terminate with wp_die and return json_encoded response )
         $class = 'WIC_Entity_' . $entity;
         $method = $_POST['sub_action'];
-        $method_response = $class::$method(  $_POST['id_requested'],  json_decode ( stripslashes ( $_POST['wic_data'] ) ) );
-
-        wp_die ( json_encode ( (object)  $method_response ) );
-                        
+        $id     =  $_POST['id_requested'];
+        $data   = json_decode ( stripslashes ( $_POST['wic_data'] ) );
+
+        // check seccurity 
+        if ( !WIC_Admin_Access::check_security ( $entity, $method, $id, $data ) ) {
+            wp_die ( $this->unassigned_message );
+        } else {
+            $method_response = $class::$method( $id, $data  );
+            wp_die ( json_encode ( (object)  $method_response ) );
+        }               
     }   
 
@@ -438 +481 @@
     public function route_ajax_upload() {
         $this->dictionary_setup();
-        $this->check_security( 'constituent' );
-        WIC_Entity_Upload_Upload::handle_upload();
+        if( !WIC_Admin_Access::check_security( 'upload','','','' ) ) {
+            wp_die ( $this->unassigned_message );
+        } else {
+            WIC_Entity_Upload_Upload::handle_upload();
+        }
     }
     public function route_ajax_document_upload() {
 
         $this->dictionary_setup();
-        $this->check_security( 'constituent' );
-
         // set values
         $constituent_id = isset ( $_REQUEST['constituent_id'] ) ? $_REQUEST['constituent_id'] : 0 ;
         $issue = isset ( $_REQUEST['issue'] ) ? $_REQUEST['issue'] : 0;
-    
-        WIC_Entity_Upload_Upload::handle_document_upload( $constituent_id, $issue );    
+        
+        if ( !WIC_Admin_Access::check_security ( $constituent_id ? 'constituent' : 'issue', '', $constituent_id ? $constituent_id : $issue , '' ) ) {
+            wp_die ( $this->unassigned_message );
+        } else {
+            WIC_Entity_Upload_Upload::handle_document_upload( $constituent_id, $issue );    
+        }
     }
     public function route_ajax_attachment_upload() {
         $this->dictionary_setup();
-        $this->check_security( 'constituent' );
-        $draft_id = $_REQUEST['draft_id'];  
-        WIC_Entity_Upload_Upload::handle_attachment_upload( $draft_id );    
+        if ( !WIC_Admin_Access::check_security( 'email_send', 'update_draft','','' ) ) {
+            wp_die ( $this->unassigned_message );
+        } else {
+            $draft_id = $_REQUEST['draft_id'];  
+            WIC_Entity_Upload_Upload::handle_attachment_upload( $draft_id ); // may not know constituent    
+        }
     }
     
@@ -466 +517 @@
         // nonce is in the get string where it is expected by check_security
         if ( isset( $_GET['entity'] ) && $_GET['entity'] == 'email_oauth' && $_GET['action'] == 'redirect_to_gmail' ) {
-            self::check_security ( 'email_oauth' ); // includes nonce checking in get string
-            WIC_Entity_Email_OAUTH::redirect_to_gmail();
+            if( !WIC_Admin_Access::check_security ( 'email_oauth', 'oauth','','' ) ) { // includes nonce checking in get string
+                wp_die ( $this->unassigned_message );
+            } else {
+                WIC_Entity_Email_OAUTH::redirect_to_gmail();
+            } 
         // nonce, along with blog ID is in the state returned
         } elseif ( isset( $_GET['entity'] ) && $_GET['entity'] == 'email_oauth' && $_GET['action'] == 'redirect_from_gmail' ) {
@@ -477 +531 @@
             // pack the nonce value for checking by check_surecity
             $_GET['oauth_nonce'] = $security_array[1];
-            self::check_security ( 'email_oauth' ); // includes nonce-checking
             WIC_Entity_Email_OAUTH::redirect_from_gmail();
+            if( !WIC_Admin_Access::check_security ( 'email_oauth', 'oauth','','' ) ) { // includes nonce checking in get string
+                wp_die ( $this->unassigned_message );
+            } else {
+                WIC_Entity_Email_OAUTH::redirect_from_gmail();
+            } 
         }
     }
@@ -497 +555 @@
         }
 
+        // check access level to function
         $parameters = explode (  ',', $_POST['wic-export-parameters'] );
-        $this->check_security ( 'document' == $parameters[0] ? '' : 'download' ); // treat document downloads as part of general WP Issues CRM acccess
-
         $class      = 'WIC_List_' . $parameters[0] . '_Export';
         $method     = 'do_'       . $parameters[1] . '_download';
         $type       = $parameters[2];
         $id_data    = $parameters[3];
-        $class::$method ( $type, $id_data );
+
+        if (! WIC_Admin_Access::check_security ( 'document' == $parameters[0] ? 'activity' : 'download','popup_save_update', $id_data,'' ) ) { // will not see $method in check_security for download (no array)
+            wp_die( $this->unassigned_message ) ;
+        } else {
+            $class::$method ( $type, $id_data );
+        }
 
     }
@@ -510 +572 @@
     *
     * action to capture get requests for image and email attachment downloads
-    *
+    * 
     */
     public function emit_stored_file () {
@@ -524 +586 @@
             return;
         }
-        // check security at the read email level
-        self::check_security( 'email' );
-        
+
         $message_in_outbox = isset( $_GET['message_in_outbox'] ) ? $_GET['message_in_outbox'] : 0;
-        WIC_Entity_Email_Attachment::emit_stored_file ( $_GET['attachment_id'],  $_GET['message_id'], $message_in_outbox );
-    }
-    /*
-    *
-    * check capabilities and nonces for ajax functions, including posts ( note that capability checking done by WP on gets -- no nonces on our gets (no updates) )
-    *
-    * if all security is passed, return requesting page (which may be false) -- false is not a security error -- die on security error
-    *
-    */
-    private function check_security ( $entity ) {
-
-        // do a reverse lookup in the nav_array to find if entity has special security level ( e.g., settings or options or manage storage )
-        $found_entity = false;
-        $entity_special_security = false;
-        $requesting_page = false;
-        foreach ( $this->nav_array as $page => $parms ) {
-            foreach ( $parms['permitted'] as $permitted ) {
-                if ( $entity == $permitted[0] ) {
-                    $found_entity = true;
-                    break;
-                }
-            }
-            if ( $found_entity ) {
-                $entity_special_security = $parms['security'];
-                $requesting_page = $page;
-                break;
-            }
-        }
-
-        /*
-        *
-        * set required capability based on entity special or based on security level for function
-        *   function levels are '' for general wic access, 'email' for inbox functions (including attachments), 'downloads' for downloads (including documents, but not attachments)
-        *
-        * note that the fourth permission level list_send security is enforced by not displaying send button and also in the send function
-        */
-        if ( $entity_special_security )  {
-            $required_capability = $entity_special_security; 
-        } else  { // downloads, general or email have own security levels
-            if ( 'email' == $entity ) {
-                $security_level = 'email';
-            } elseif ( 'download' == $entity  ) {
-                $security_level = 'downloads'; // note the 's'
-            } else {
-                $security_level = '';
-            }
-            $required_capability = self::check_required_capability ( $security_level );
-        } 
-
-        // see if user can do function -- should never be failing this except as an application error or a deliberate security breach, so just die
-        if ( ! current_user_can ( $required_capability ) ) {
-            wp_die( sprintf( __( 'Please consult your administrator for access to %s functions', 'wp-issues-crm' ), $entity ) );    
-        }
-
-        // now check nonce -- either of four possible nonces are OK
-        $request_nonce  = isset ( $_POST['wic_ajax_nonce'] ) ?  $_POST['wic_ajax_nonce'] : '';
-        $form_nonce     = isset ( $_REQUEST['wp_issues_crm_post_form_nonce_field'] ) ? $_REQUEST['wp_issues_crm_post_form_nonce_field'] : '' ; 
-        $oauth_nonce    = isset ( $_GET['oauth_nonce'] ) ?  $_GET['oauth_nonce'] : '';
-        $attachment_nonce = isset( $_GET['attachment_nonce'] ) ?  $_GET['attachment_nonce'] : '';
-        $attachment_id = isset ( $_GET['attachment_id'] ) ? $_GET['attachment_id'] : '';
-        if ( ! wp_verify_nonce ( $request_nonce, 'wic_ajax_nonce' )  && 
-             ! wp_verify_nonce ( $form_nonce, 'wp_issues_crm_post' ) &&
-             ! wp_verify_nonce ( $oauth_nonce, 'wic_oauth' ) &&
-             ! wp_verify_nonce ( $attachment_nonce, 'attachment_' . $attachment_id )
-            ) { 
-             die ( __( 'Bad or expired security code.  Try refreshing page.', 'wp_issues_crm' ) );      
-        }
-        
-        return ( $requesting_page );
-        
-    }
-
-    // check download or general security level setting
-    public static function check_required_capability ( $type = '' ) { 
-        // get security level setting
-        $wic_plugin_options = get_option( 'wp_issues_crm_plugin_options_array' ); 
-        $option = $type > '' ? ( 'access_level_required_' . $type ) : 'access_level_required';
-        $required_capability = isset( $wic_plugin_options[$option] ) ? $wic_plugin_options[$option] : 'edit_theme_options';
-        // handle upgrade to 3.5 case in network setting, where old option selected was 'activate_plugins'
-        if ( 'activate_plugins' == $required_capability ) {
-            $required_capability = 'edit_theme_options';
-        }   
-        return $required_capability;
-    }
+
+        if (! WIC_Admin_Access::check_security ( 'email_message','load_full_message', $_GET['message_id'], $message_in_outbox ) ) {
+            wp_die( $this->unassigned_message ) ;
+        } else {
+            WIC_Entity_Email_Attachment::emit_stored_file ( $_GET['attachment_id'],  $_GET['message_id'], $message_in_outbox );
+        }
+    
+                
+    }
+
+    
 
 }

wp-issues-crm/trunk/php/admin/class-wic-admin-settings.php

@@ -67 +67 @@
             'security_settings' // settings section within page
        ); 
+
+      add_settings_field(
+            'access_level_required_view_edit_unassigned', // field id
+            'Access unassigned', // field label
+            array( $this, 'access_level_required_view_edit_unassigned_callback' ), // field call back 
+            'wp_issues_crm_settings_page', // page 
+            'security_settings' // settings section within page
+       ); 
             
       add_settings_field(
@@ -78 +86 @@
       add_settings_field(
             'access_level_required_email', // field id
-            'Read and reply to email', // field label
+            'Send email', // field label
             array( $this, 'access_level_required_email_callback' ), // field call back 
             'wp_issues_crm_settings_page', // page 
@@ -91 +99 @@
             'security_settings' // settings section within page
        ); 
-       
+
        // Privacy Settings
       add_settings_section(
@@ -501 +509 @@
             <table class="wp-issues-crm-stats">
                 <tbody>
-                    <tr><td>Chrome -- strongly recommended and heavily tested.</td></tr>
-                    <tr><td>Firefox -- less heavily tested; will generate errors when accessing browser history due to internal limits.</td></tr>
+                    <tr><td>Chrome -- performs best.</td></tr>
+                    <tr><td>Firefox -- also recommended, and supports better privacy, but may generate errors when accessing browser history due to internal limits.</td></tr>
                     <tr><td>Safari -- not well supported; the open source editor we use for email composition, tinymce, does not perform perfectly in Safari.</td></tr>
-                    <tr><td>Explorer -- NOT supported;  Explorer does not support all modern Javascript language constructs that WP Issues CRM requires.</td></tr>
+                    <tr><td>Explorer/Edge -- NOT supported;  Explorer does not support all modern Javascript language constructs that WP Issues CRM requires.  Edge does not handle formatting consistently.</td></tr>
             </table>
         <p><em>The basic WP Issues CRM forms and lists are responsive for mobile browsers, but look better on a desktop. 
@@ -672 +680 @@
     public function security_settings_legend() {
         echo'<p>' . __( 'Only logged-in users can access WP Issues CRM.') . '</p>' . 
-            '<p>' . __( 'You can control who among your logged-in users can access (a) any WP Issues CRM functions; (b) bulk constituent and activity downloads and deletion; (c) email reading and replying.
-            (d) sending emails to lists. Administrators always have access to all four.') . '</p><p>' .
+            '<p>' . __( 'You can control who among your logged-in users can access (a) any WP Issues CRM functions; (b) constituents, issues and emails that have not been assigned to them (c) bulk constituent and activity downloads and deletion; (d) email archiving and sending;
+            (e) sending emails to lists. Administrators always have access to WP Issues CRM and all four specific capabilities. Note that constituents created or last updated by a user may always be accessed by the user, even if not formally assigned to them.') . '</p><p>' .
             __(  'You assign users to roles ("Administrator", "Editor" . . . ) as part of their user profiles.  Here, you grant access to user roles with particular <a href="https://codex.wordpress.org/Roles_and_Capabilities" target = "_blank">Wordpress capabilities</a>. 
             Access is hierarchical.  For example, if you grant access to "Authors", then those with additional capabilities, "Editors" and "Administators", will also have access, but "Contributors" and "Subscribers" will not.', 'wp-issues-crm' ) .  '</p><p>' .
@@ -740 +748 @@
     }   
 
+
+    // setting field call back  
+    public function access_level_required_view_edit_unassigned_callback() {
+        global $wic_db_dictionary; 
+        $option_array = $wic_db_dictionary->lookup_option_values( 'capability_levels' );        
+        
+        $value = isset ( $this->plugin_options['access_level_required_view_edit_unassigned'] ) ? $this->plugin_options['access_level_required_view_edit_unassigned'] : 'edit_theme_options';
+
+        $args = array (
+            'field_label'       => '',
+            'option_array'      => $option_array,
+            'input_class'       => '',
+            'field_slug_css'    => '',
+            'hidden'            => '',
+            'field_slug'        => 'wp_issues_crm_plugin_options_array[access_level_required_view_edit_unassigned]',
+            'value'             => $value ,     
+        );      
+        echo WIC_Control_Select::create_control( $args );
+    }
 
     // setting field call back  
@@ -1467 +1494 @@
       if( isset( $input['access_level_required_list_send'] ) ) {
             $new_input['access_level_required_list_send'] = sanitize_text_field( $input['access_level_required_list_send'] );
-      }       
+      }  
+      if( isset( $input['access_level_required_view_edit_unassigned'] ) ) {
+            $new_input['access_level_required_view_edit_unassigned'] = sanitize_text_field( $input['access_level_required_view_edit_unassigned'] );
+      }        
+           
       // privacy settings 
       if( isset( $input['all_posts_private'] ) ) {

wp-issues-crm/trunk/php/admin/class-wic-admin-setup.php

@@ -286 +286 @@
                     'maxFileSize' => WIC_Entity_Upload_Upload::get_safe_file_size(),
                     'dearToken' => WIC_Entity_Email_Send::dear_token,
+                    'canSendEmail' => current_user_can (WIC_Admin_Access::check_required_capability ('email')),
+                    'canViewOthersAssigned' => current_user_can (WIC_Admin_Access::check_required_capability ('view_edit_unassigned')),
                 ) 
             );              

wp-issues-crm/trunk/php/db/class-wic-db-email-message-object.php

@@ -162 +162 @@
             $message_object->is_my_constituent          =  $message_array[0]->is_my_constituent_guess; // translating from guess to non guess for save purposes
             $message_object->display_date               =  $message_object->email_date_time;
+            $message_object->inbox_defined_staff        =  $message_array[0]->inbox_defined_staff;
+            $message_object->inbox_defined_issue        =  $message_array[0]->inbox_defined_issue;
+            $message_object->inbox_defined_pro_con      =  $message_array[0]->inbox_defined_pro_con;
+            $message_object->inbox_defined_reply_text   =  $message_array[0]->inbox_defined_reply_text;
+            $message_object->inbox_defined_reply_is_final   =  $message_array[0]->inbox_defined_reply_is_final;
+
             // at time of parse, attempted to find matching constituent
             if ( $message_array[0]->assigned_constituent ) {

wp-issues-crm/trunk/php/entity/class-wic-entity-activity.php

@@ -129 +129 @@
             $buttons .= WIC_List_Activity::reassign_activities_button ( $search_parms, 'issue' );
 
-            $required_capability = WIC_Admin_Navigation::check_required_capability( 'downloads' ); // downloads
+            $required_capability = WIC_Admin_Access::check_required_capability( 'downloads' ); // downloads
             if (current_user_can( $required_capability ) ) {
                 $buttons .= WIC_List_Activity::delete_activities_button ( $search_parms, 'issue');

wp-issues-crm/trunk/php/entity/class-wic-entity-dashboard.php

@@ -27 +27 @@
         } else {
             $sort_list = array();
-            $wide_list = array( 'dashboard_issues','dashboard_cases','dashboard_activity', 'dashboard_activity_type', 'dashboard_recent', 'dashboard_searches', 'dashboard_uploads' );
+            $wide_list = array( 'dashboard_mycases', 'dashboard_myissues', 'dashboard_issues','dashboard_cases','dashboard_activity', 'dashboard_activity_type', 'dashboard_recent', 'dashboard_searches', 'dashboard_uploads' );
             $tall_list = array();
         }   
-            
-        // inventory of dashboard widgets and titles
-        $dashboard_divs = array (
-            'dashboard_issues'          => 'Assigned Issues', 
-            'dashboard_cases'           => 'Assigned Cases', 
-            'dashboard_activity'        => 'Constituents with Activity by Issue',
-            'dashboard_activity_type'   => 'Activities by Issue and Type',
-            'dashboard_recent'          => 'Recently Updated',
-            'dashboard_searches'        => 'Search Log',
-            'dashboard_uploads'         => 'Uploads', 
-        );
-        
+        if ( current_user_can (WIC_Admin_Access::check_required_capability ('view_edit_unassigned') ) ) {
+            // inventory of dashboard widgets and titles
+            $dashboard_divs = array (
+                'dashboard_overview'        => 'Staff Work Status',
+                'dashboard_issues'          => 'Assigned Issues', 
+                'dashboard_cases'           => 'Assigned Cases', 
+                'dashboard_activity'        => 'Constituents with Activity by Issue',
+                'dashboard_activity_type'   => 'Activities by Issue and Type',
+                'dashboard_recent'          => 'Recently Updated',
+                'dashboard_searches'        => 'Search Log',
+                'dashboard_uploads'         => 'Uploads', 
+            );
+        } else {
+            // inventory of dashboard widgets and titles
+            $dashboard_divs = array (
+                'dashboard_overview'        => 'Staff Work Status',
+                'dashboard_myissues'        => 'Assigned Issues', 
+                'dashboard_mycases'         => 'Assigned Cases', 
+            );
+        }
         // sort the inventory
         $sorted_dashboard_divs = array();
@@ -73 +81 @@
     }
 
-    public static function dashboard_email ( $dummy_id, $dummy_data ) {
-        return array ( 'response_code' => true, 'output' => '<div class="dashboard-not-found">Email Stuff</div>' ); 
-    }
-    
+
     public static function save_dashboard_preferences ( $dummy_id, $data ) {
         return WIC_Entity_User::set_wic_user_preference ( 'wic_dashboard_config', $data );
     }
-    
-    // display a list of CASES assigned to user -- OBSOLETE, BUT LEAVING IT HERE IN CASE WANT TO USE IT FOR LOWER LEVEL USERS AT SOME POINT (SEE ONLY OWN, NO OPTIONS)  
+
+    public static function dashboard_overview ( $dummy_id, $dummy_data ) {
+    
+        global $wpdb;
+        $constituent_table = $wpdb->prefix . 'wic_constituent';
+        $post_meta_table = $wpdb->postmeta;
+        $inbox_image_table = $wpdb->prefix . 'wic_inbox_image';
+        $user_table = $wpdb->users;
+        // get current folder
+        $folder = WIC_Entity_Email_Account::get_folder();
+        
+        $constituent_sql = "
+             SELECT case_assigned as user_id, count(id) as cases_open, sum(if( case_review_date < NOW(), 1, 0)) as cases_overdue FROM $constituent_table WHERE case_status = 1 GROUP BY case_assigned
+        ";
+    
+        $issue_sql = "
+            SELECT m3.meta_value as user_id, count(m1.meta_id) as issues_open, sum(if(m2.meta_value < NOW() OR m2.meta_value is null, 1, 0) ) as issues_overdue 
+            FROM $post_meta_table m1 
+            LEFT JOIN $post_meta_table m2 on m2.post_id = m1.post_id and m2.meta_key = 'wic_data_review_date'
+            LEFT JOIN $post_meta_table m3 on m3.post_id = m1.post_id and m3.meta_key = 'wic_data_issue_staff' 
+            WHERE m1.meta_key = 'wic_data_follow_up_status' AND m1.meta_value = 'open'
+            GROUP BY m3.meta_value
+        ";
+    
+        $message_sql = "
+            SELECT 
+                inbox_defined_staff as user_id, 
+                count(id) as count_assigned_messages, 
+                sum(if( 0 = inbox_defined_reply_is_final, 1, 0 )) as unfinalized_messages,  
+                left( min(if( 0 = inbox_defined_reply_is_final, email_date_time, '9999-99-99' )), 10) as oldest_unanswered
+            FROM $inbox_image_table WHERE inbox_defined_staff > 0 AND
+                full_folder_string = '$folder' AND
+                no_longer_in_server_folder = 0 AND
+                to_be_moved_on_server = 0 AND
+                serialized_email_object > ''
+                GROUP BY inbox_defined_staff
+            ";  
+        // get values
+        $case_assigned_array        = $wpdb->get_results ( $constituent_sql );
+        $issue_assigned_array       = $wpdb->get_results ( $issue_sql );
+        $message_assigned_array     = $wpdb->get_results ( $message_sql );
+        // construct array of user ids to report on
+        $user_ids = array();
+        foreach ( $case_assigned_array as $line ) {
+            if ( !array_key_exists ( $line->user_id, $user_ids ) ) {
+                $user_ids[$line->user_id] = array();
+            }
+            $user_ids[$line->user_id]['cases_open'] = $line->cases_open;
+            $user_ids[$line->user_id]['cases_overdue'] = $line->cases_overdue;
+        }
+        foreach ( $issue_assigned_array as $line ) {
+            if ( !array_key_exists (  $line->user_id, $user_ids ) ) {
+                $user_ids[$line->user_id] = array();
+            }
+            $user_ids[$line->user_id]['issues_open'] = $line->issues_open;
+            $user_ids[$line->user_id]['issues_overdue'] = $line->issues_overdue;
+        }
+        foreach ( $message_assigned_array as $line ) {
+            if ( !array_key_exists ( $line->user_id, $user_ids ) ) {
+                $user_ids[$line->user_id] = array();
+            }
+            $user_ids[$line->user_id]['count_assigned_messages'] = $line->count_assigned_messages;
+            $user_ids[$line->user_id]['unfinalized_messages'] = $line->unfinalized_messages;
+            $user_ids[$line->user_id]['oldest_unanswered'] = $line->oldest_unanswered;
+
+        }               
+        
+        if ( !count ( $user_ids ) ) {
+            return array ( 'response_code' => true, 'output' => '<div class="dashboard-not-found">No work assignments found.</div>' );  
+        }
+        
+        $user_login_array = array();
+        foreach ($user_ids as $user_id => $values ) {
+            if ( $user_id > 0 ) {
+                $user_data = get_userdata($user_id);
+                $user_display_name = $user_data->display_name ? $user_data->display_name : $user_data->user_login;
+            } else {
+                $user_display_name = 'Unassigned';
+            }
+            $user_login_array[$user_display_name] = $values;
+        }
+        
+        ksort ( $user_login_array );
+        
+        $output = '<table id="wic-work-flow-status">
+            <tr>
+                <th>User Id</th>
+                <th>Open Cases</th>
+                <th>Overdue Cases</th>
+                <th>Open Issues</th>
+                <th>Overdue Issues</th>
+                <th>Assigned Messages</th>
+                <th>Unanswered Messages</th>
+                <th>Oldest Unanswered</th>
+            </tr>';
+        foreach ( $user_login_array as $user_login => $values ) {
+            $output .= '<tr>' .
+                '<td>' . $user_login . '</td>' .
+                '<td>' . ( isset( $values['cases_open'] ) ? $values['cases_open']: 0 ) . '</td>' .
+                '<td class="' . ( isset( $values['cases_overdue'] ) && $values['cases_overdue'] > 0 ? 'wic-staff-overdue-assignment' : '' ) . '">' . ( isset( $values['cases_overdue'] ) ? $values['cases_overdue']: 0 ) . '</td>' .
+                '<td>' . ( isset( $values['issues_open'] ) ? $values['issues_open']: 0 ) . '</td>' .
+                '<td class="' . ( isset( $values['issues_overdue'] ) && $values['issues_overdue'] > 0 ? 'wic-staff-overdue-assignment' : '' ) . '">' . ( isset( $values['issues_overdue'] ) ? $values['issues_overdue']: 0 ) . '</td>' .
+                '<td>' . ( isset( $values['count_assigned_messages'] ) ? $values['count_assigned_messages']: 0 ) . '</td>' .
+                '<td class="' . ( isset( $values['unfinalized_messages'] ) && $values['unfinalized_messages'] > 0 ? 'wic-staff-overdue-assignment' : '' ) . '">'  . ( isset( $values['unfinalized_messages'] ) ? $values['unfinalized_messages']: 0 ) . '</td>' .
+                '<td class="wic-email-dashboard-date">'  . ( isset( $values['oldest_unanswered'] ) &&  $values['oldest_unanswered'] != '9999-99-99' ? $values['oldest_unanswered']: '--' ) . '</td>' .
+            '</tr>';
+        }
+        $output .= "</table>";
+
+        return array ( 'response_code' => true, 'output' => $output );  
+    }
+    
+    // display a list of CASES assigned to user --  (SEE ONLY OWN, NO OPTIONS)  
     public static function dashboard_mycases( ) {
         
@@ -124 +240 @@
     }
         
-    // display a list of issues assigned to user -- OBSOLETE, BUT LEAVING IT HERE IN CASE WANT TO USE IT FOR LOWER LEVEL USERS AT SOME POINT (SEE ONLY OWN, NO OPTIONS) 
+    // display a list of issues assigned to user --  (SEE ONLY OWN, NO OPTIONS) 
     public static function dashboard_myissues() { 
         
@@ -238 +354 @@
         );
 
-        $search_array = array (
-            array (
-                 'table'    => 'issue',
-                 'key'  => 'issue_staff',
-                 'value'    => $issue_staff,
-                 'compare'  => $issue_staff ? '=' : '>',
-                 'wp_query_parameter' => '',
-            ),
-        );
-
+        if ( $issue_staff ) {
+            $search_array = array (
+                array (
+                     'table'    => 'issue',
+                     'key'  => 'issue_staff',
+                     'value'    => $issue_staff,
+                     'compare'  => '=',
+                     'wp_query_parameter' => '',
+                ),
+            );
+        } else {
+            $search_array = array();
+        }
+    
         if ( $follow_up_status !== '') {
             $status_term = array (

wp-issues-crm/trunk/php/entity/class-wic-entity-email-account.php

@@ -179 +179 @@
         *
         * the array should always include 'Advocacy' as this special tab is used dynamically to group emails with subject lines that are mapped to issues
+        * the array should always include 'Team' as this special tab is used dynamically to group emails from users having access to WP Issues CRM
+        * the array should always include 'Assigned' as this special tab is used dynamically to group emails assigned for response to current user
+        * the array should always include 'Ready' as this special tab is used dynamically to group emails that have drafts ready for response
         *
         * the category filter should catch every message -- messages with blank categories will not be displayed
@@ -196 +199 @@
                 'Promotions',
                 'Updates',
-                'Forums'
+                'Forums',
+                'Team',
+                'Assigned',
+                'Ready'
             );
         }
-
-        return array ( 'General', 'Advocacy' );
+ 
+        return array (  'General', 'Advocacy', 'Team', 'Assigned', 'Ready' );
         
     }

wp-issues-crm/trunk/php/entity/class-wic-entity-email-block.php

@@ -113 +113 @@
 
     public static function load_block_list ( $dummy1, $dummy2 ) {
+    
         global $wpdb;
         $filter_table = $wpdb->prefix . 'wic_inbox_incoming_filter';

wp-issues-crm/trunk/php/entity/class-wic-entity-email-inbox-parse.php

@@ -181 +181 @@
         }
 
-        // subject and category local filters -- may be defined in a local plugin -- gmail supplies own category
+        // subject and category local filters -- may be defined in a local plugin -- gmail supplies own category, but local can override
         // https://developer.wordpress.org/reference/functions/apply_filters/
         $subject    =   apply_filters ( 'wp_issues_crm_local_subject_filter', $email_object->subject, $email_object );  
@@ -188 +188 @@
             $email_object->category = 'CATEGORY_GENERAL';
         }
+        // apply category filter for team members before local category function
+        $email_object->category = get_user_by( 'email', $email_object->from_email ) ? 'CATEGORY_TEAM' : $email_object->category;
+        
+        // local category filter may or may not respect CATEGORY_TEAM
         $category   =   apply_filters ( 'wp_issues_crm_local_category_filter', $email_object->category, $email_object, 'Y' == $is_my_constituent ); 
 

wp-issues-crm/trunk/php/entity/class-wic-entity-email-inbox.php

@@ -21 +21 @@
     // special version of this function to allow checking of settings before form display 
     protected function new_blank_form( $args = '', $guidance = '' ) { 
-
-        $required_capability = WIC_Admin_Navigation::check_required_capability( 'email' );
-        if ( ! current_user_can( $required_capability ) ) {
-            echo '<div id="inbox-congrats">Check with your site administrator to upgrade your role if you need to access email functions.</div>';
-            return;
-        }
 
         $wic_settings = get_option( 'wp_issues_crm_plugin_options_array' );
@@ -80 +74 @@
         * 
         */
-
-        $required_capability = WIC_Admin_Navigation::check_required_capability( 'email' );
-        if ( ! current_user_can( $required_capability ) ) {
-            return array ( 'response_code' => false, 'output' => 'Security violation.  Current user role not authorized to access inbox.' );
+        // enforce limit on access to assigned only
+        $user_can_see_all = current_user_can ( WIC_Admin_Access::check_required_capability( 'view_edit_unassigned' ) );
+        if ( ! $user_can_see_all && !in_array( $data->tab, array( 'CATEGORY_ASSIGNED', 'CATEGORY_READY') ) ) {
+            $data->tab = 'CATEGORY_ASSIGNED' ;
         }
 
@@ -109 +103 @@
         *   (2) They all have content mapped to the same issue/pro-con, which agrees with the subject mapped result
         *   (3) The content match meets both the required confidence percentage and the required word count percentage
+        *   (4) HAVE NOT HAD ANY INDIVIDUAL MESSAGE INBOX DEFINITION ACTIVITY
         *   NOTE: There may or may not be a reply already assigned to the issue -- could be just recording
         *
@@ -141 +136 @@
         /*
         * sweep_definition is critical concept that enforces strictness of automated reply processing per notes above
+        *
+        * added inbox_defined terms exclude items that have had individual attention from the inbox in any grouping
         */
         $inbox_image_table = $wpdb->prefix . 'wic_inbox_image';
@@ -149 +146 @@
             guess_mapped_pro_con = mapped_pro_con AND
             guess_mapped_issue_confidence >= $mapped_threshold AND 
-            non_address_word_count >= $word_minimum_threshold ";
+            non_address_word_count >= $word_minimum_threshold AND
+            inbox_defined_staff = 0 AND
+            inbox_defined_issue = 0 AND
+            inbox_defined_pro_con = '' AND
+            inbox_defined_reply_text = ''
+            ";
 
         $filter = sanitize_text_field ( $data->filter );
         $filter_where = self::filter_where ( $filter );
 
-        // add tab selection terms -- CATEGORY_ADVOCACY is special, dynamically applied
+        // add tab selection terms -- CATEGORY_ADVOCACY, CATEGORY_ASSIGNED, CATEGORY_READY special, dynamically applied
         $category_where = $wpdb->prepare (
-                " IF(mapped_issue > 0, 'CATEGORY_ADVOCACY', category ) = %s AND ",
+                "IF( 
+                    assigned_subject is NULL AND constituent_assigned_staff is NULL, 
+                    IF( mapped_issue > 0, 'CATEGORY_ADVOCACY', category ), 
+                    IF( subject_is_final, 'CATEGORY_READY', 'CATEGORY_ASSIGNED' )
+                ) = %s AND ",
                 array ( $data->tab )
             );
@@ -169 +175 @@
 
         // key implementing language for group options (note that higher parse_quality number is worse parse, up to 6 with no email address
+        $sort_assigned_to_top = ( $data->tab == 'CATEGORY_ASSIGNED' || $data->tab == 'CATEGORY_READY' ) ? " if( inbox_defined_staff, 1, 0) DESC, " : '';
         $group_lines =
             "GROUP BY BINARY
@@ -176 +183 @@
                 )
 
-            ORDER BY min( if ( account_thread_latest > '', account_thread_latest, email_date_time ) ) " . $data->sort . ',  min(email_date_time) ' . $data->sort . '';
+            ORDER BY  $sort_assigned_to_top min( if ( account_thread_latest > '', account_thread_latest, email_date_time ) ) " . $data->sort . ',  min(email_date_time) ' . $data->sort . '';
         $ungroup_lines = 
-            " ORDER BY IF ( account_thread_latest > '', account_thread_latest, email_date_time )  " . $data->sort .  ',  email_date_time ' . $data->sort . '';
-
+            " ORDER BY $sort_assigned_to_top IF ( account_thread_latest > '', account_thread_latest, email_date_time )  " . $data->sort .  ',  email_date_time ' . $data->sort . '';
+
+        /*
+        *
+        * joins to support Assigned and Ready tabs
+        *
+        */
+        // does the user have access to the whole inbox?
+        $current_user_id = get_current_user_id();
+        $user_subject_where_limit = $user_can_see_all ? 
+            ( 
+                " WHERE inbox_defined_staff " . 
+                    (
+                        $data->staff ? 
+                            $wpdb->prepare ( " = %s ", $data->staff ) :
+                            " > '' "
+                    )    
+            ) : 
+            "WHERE inbox_defined_staff = $current_user_id ";
+        // join to identify assigned emails/subjects
+        $assigned_subject_join = 
+            "
+            LEFT JOIN 
+                (  
+                  SELECT max(inbox_defined_reply_is_final) as subject_is_final, subject as assigned_subject 
+                  FROM $inbox_image_table 
+                  $user_subject_where_limit AND $other_where_terms
+                  GROUP BY subject
+                ) assigned_subjects 
+            ON subject = assigned_subject 
+            ";
+        // join to identify_assigned_constituents
+        $constituent_table = $wpdb->prefix . 'wic_constituent';
+        $user_constituent_where_limit = $user_can_see_all ? " WHERE case_assigned > '' " : "WHERE case_assigned = $current_user_id ";
+        $assigned_constituent_join = 
+            "
+            LEFT JOIN 
+                ( 
+                SELECT c.id as constituent_id, case_assigned as constituent_assigned_staff FROM
+                $inbox_image_table INNER JOIN $constituent_table c ON c.id = assigned_constituent
+                $user_constituent_where_limit AND $other_where_terms 
+                GROUP BY c.id
+                ) assigned_constituents
+            ON assigned_constituent = constituent_id
+            ";
 
         /*
@@ -190 +240 @@
         foreach ( $tabs_array  as $tab ) {
             $category = 'CATEGORY_' . strtoupper( $tab ); 
-            $tabs_summary_sql .= 
-                ", SUM(IF(" . 
-                    (
-                        'CATEGORY_ADVOCACY' == $category ? 
-                        "mapped_issue > 0 OR category = '$category'" :
-                        "mapped_issue = 0 AND category = '$category'" 
-                    ) .
-                ", 1, 0)) as $category";
-        }       
+            $tabs_summary_sql .= ", SUM(IF(" ; 
+            switch ( $category) {
+                case 'CATEGORY_READY':
+                    $tabs_summary_sql .= 
+                        "(  assigned_subject IS NOT NULL OR constituent_assigned_staff IS NOT NULL ) AND subject_is_final > 0, ";
+                    break;
+                case 'CATEGORY_ASSIGNED':
+                    $tabs_summary_sql .= 
+                        "(  assigned_subject IS NOT NULL OR constituent_assigned_staff IS NOT NULL ) AND subject_is_final = 0, ";
+                    break;
+                case 'CATEGORY_ADVOCACY':
+                    $tabs_summary_sql .= 
+                        "(  assigned_subject IS NULL AND constituent_assigned_staff IS NULL ) AND ( mapped_issue > 0 OR category = '$category' ), ";
+                    break;
+                default:
+                    $tabs_summary_sql .= 
+                        "(  assigned_subject IS NULL AND constituent_assigned_staff IS NULL ) AND ( mapped_issue = 0 AND category = '$category' ), ";               
+            } 
+            $tabs_summary_sql .= "1, 0)) as $category";
+                
+        }
+                
         $tabs_count_sql =       
             "
             SELECT count(ID) as all_inbox_messages_count $tabs_summary_sql
-            FROM $inbox_image_table
+            FROM $inbox_image_table $assigned_subject_join $assigned_constituent_join
             WHERE $other_where_terms            
             "
-        ;
+        ;       
+
         $tab_counts = $wpdb->get_results ( $tabs_count_sql ); 
 
@@ -219 +283 @@
             " 
             SELECT SQL_CALC_FOUND_ROWS
+                inbox_defined_staff,
                 account_thread_latest,
                 subject,
@@ -237 +302 @@
             "
             SELECT SQL_CALC_FOUND_ROWS
+                inbox_defined_staff,
                 max(account_thread_latest) as account_thread_latest,
                 subject,
@@ -254 +320 @@
             ) . 
             "
-            FROM $inbox_image_table
+            FROM $inbox_image_table $assigned_subject_join $assigned_constituent_join
             WHERE 
                 $filter_where
@@ -269 +335 @@
             "
             ;
-
         // get subjects array
         $subjects_array = $wpdb->get_results( $subjects_array_sql );
@@ -280 +345 @@
         $loaded_object = 'grouped' == $data->mode ? 'subject lines' :   'messages';
         $filter_statement = $filter ? ' (filtered by "' . $filter . '")' : '';
-        $view_statement = "Viewing $loaded_object, $sort_order first" . "$filter_statement. $max_count per page." ;
+        // define user limit statement
+        if ( ( ! $user_can_see_all || $data->staff  ) && ( $data->tab == 'CATEGORY_ASSIGNED' || $data->tab == 'CATEGORY_READY' ) ) {
+            $user_data = get_userdata( $user_can_see_all ? $data->staff : $current_user_id );
+            $user_display_name = $user_data->display_name ? $user_data->display_name : $user_data->user_login;      
+            $user_limit_statement = ' Limited to messages assigned to ' . $user_display_name . '. ';
+        } else {
+            $user_limit_statement = '';
+        }
+        $view_statement = "Viewing $loaded_object, $sort_order first" . "$filter_statement. $max_count per page. $user_limit_statement" ;
 
         $count_subjects = 0;
@@ -305 +378 @@
                     $trained_legend = '';
                 }
+                // mark as assigned
+                $assigned_staff_class =  $subject->inbox_defined_staff ? ' inbox-assigned-staff ' : '';
                 /*
                 * manage truncated UID list -- can't count on ability of user to set session value for group_concat_max_len over 1024
@@ -335 +410 @@
                         '<li class = "subject-line-item from-summary' . ( 'Y' == $subject->mine ? ' includes-constituents ' : '' ) . '">' . $from_summary. '</li>' . // just display
                         '<li class = "subject-line-item count" title = "Message Count"><span class="inner-count">' . $uid_count . '</span></li>' . // *supports multiple UI elements*
-                        '<li class = "subject-line-item subject' . $trained_class . '">' . $thread_child .  $trained_legend . '<span class="actual-email-subject">' . $subject->subject . '</span><span class="wic-email-snippet">' . ( $subject->snippet ? ' -- ' : '' ).$subject->snippet .'</span></li>' . // just display
+                        '<li class = "subject-line-item subject' . $trained_class . $assigned_staff_class . '">' . $thread_child .  $trained_legend . '<span class="actual-email-subject">' . $subject->subject . '</span><span class="wic-email-snippet">' . ( $subject->snippet ? ' -- ' : '' ).$subject->snippet .'</span></li>' . // just display
                         '<li class = "subject-line-item oldest" title="Date of oldest">' . $subject->oldest . '</li>' . // just display
                         '<li class = "subject-line-item UIDs">' . $uid_list . '</li>' . // *pass through for all processing*
@@ -355 +430 @@
         } else {
             if ( !$tab_counts[0]->all_inbox_messages_count ) {
-                $output = '<h3 class="all-clear-inbox-message">All clear -- done for now!</h3>';
+                $output = '<h3 class="all-clear-inbox-message">All clear -- done for now! ' . $user_limit_statement  . '</h3>';
             } else {
                 if ( ! in_array( $tab_display, WIC_Entity_Email_Account::get_tabs() ) ) {  
@@ -362 +437 @@
                     $output = $filter  ? 
                         ( '<div id = "filtered-all-warning">No from email address or subject line containing "' . $filter . '" ' . ' in ' . $tab_display  . '.</div>' ) : 
-                        ('<div id="inbox-congrats">All clear ' .  ' in ' . $tab_display . '.</div>');
+                        ('<div id="inbox-congrats">All clear ' .  ' in ' . $tab_display . '.' .$user_limit_statement .  '</div>');
                 }
             }
@@ -404 +479 @@
         );
         
-        return array ( 'response_code' => true, 'output' => $return_array  ); 
+        return array ( 'response_code' => true, 'output' => $return_array ); 
     }
 
@@ -419 +494 @@
     }
 
+
     private static function load_sent_outbox ( $sent_ok, $is_draft, $data ) { 
+    
         /*
         * Return looks like inbox to js
@@ -574 +651 @@
 
     public static function load_done ( $dummy_id, $data ) { 
+
         /*
         * looks like inbox to js and css
@@ -710 +788 @@
     
     public static function load_saved ( $dummy_id, $data ) { 
+
         /*
         * looks like inbox to js and css

wp-issues-crm/trunk/php/entity/class-wic-entity-email-message.php

@@ -92 +92 @@
             *
             * if switching subject lines, always start fresh, otherwise, just carry through user's defined values
-            * for issue/pro_con/template
+            * for issue/pro_con/template as scroll through messages within group
             */
             if ( $data->switching ) {
                 // reset all to blank
                 $data = self::reset_issue ( $data );
-                // use available data from message object only under conditions conditions:
+                // use available data from message object only under conditions:
                 if ( 
                     $message->mapped_issue > 0 &&                                   // there is a mapped issue
@@ -110 +110 @@
                     $data->template     = '<br/>' . WIC_Entity_User::get_current_user_sig();
                 }
+                // always switching when go to a line with inbox defined values because load_inbox will not group if user defined values from inbox
+                // override with these values if they exist
+                $data->issue    =   $message->inbox_defined_issue       ? $message->inbox_defined_issue         : $data->issue;
+                $data->pro_con  =   ( $message->inbox_defined_pro_con  || $message->inbox_defined_issue )   ? $message->inbox_defined_pro_con : $data->pro_con;
+                $data->template =   $message->inbox_defined_reply_text  ? $message->inbox_defined_reply_text    : $data->template;
+                
             } 
             // validate finalized issue -- still not trashed? -- parsed email object would not know that
@@ -125 +131 @@
                 'assigned_constituent_display'  => $message->assigned_constituent ? self::get_constituent_title ($message->assigned_constituent) : '',
                 'assigned_constituent'          => $message->assigned_constituent, 
-                'assigned_staff'                => $message->assigned_constituent ? WIC_Entity_Constituent::get_assigned_staff ( $message->assigned_constituent ) : 0,
+                'assigned_staff'                => $message->inbox_defined_staff,
+                'reply_is_final'                => $message->inbox_defined_reply_is_final,
                 'attachments_display_line'      => $attachments_display_line,
                 'from_email'                    => $message->from_email,
@@ -161 +168 @@
     }
     
-    public static function load_full_message ( $selected_page, $ID ) {
+    public static function load_full_message ( $ID, $selected_page ) {
         if ( ! $message = WIC_DB_Email_Message_Object::build_from_id ( $selected_page, $ID ) ) {
             return array ( 'response_code' => false, 'output' => "Could not find $selected_page message $ID on server." ); 
@@ -497 +504 @@
         $output = (object) array ( 
             'output' => $response_code ? 'Assigned constituent update OK.': 'Database error on assigned constituent update.',
-            'case_assigned' => ( $response_code && $data->assigned_constituent ) ? WIC_Entity_Constituent::get_assigned_staff( $data->assigned_constituent ) : 0,
             'constituent_name' => ( $response_code && $data->assigned_constituent ) ? WIC_DB_Access_WIC::get_constituent_name( $data->assigned_constituent ) : ''
         ); 
         return array ( 'response_code' => $response_code, 'output' => $output ); 
     } 
+
+    public static function quick_update_inbox_defined_item( $folder_uid, $data ) {
+    
+        global $wpdb;
+        $inbox_image_table = $wpdb->prefix . 'wic_inbox_image';
+        $field_to_update = 'inbox_defined_' . $data->field_to_update;
+        $sql = $wpdb->prepare (
+            "UPDATE $inbox_image_table SET $field_to_update = %s WHERE full_folder_string = %s AND folder_uid = %d ",
+            array ( $data->field_value, $data->full_folder_string, $folder_uid )
+        );
+        $result = $wpdb->query ( $sql );
+        $response_code = ( $result !== false );
+        $output = (object) array ( 
+            'output' => $response_code ? 'Assigned constituent update OK.': "Database error on $field_to_update update.",
+        ); 
+        return array ( 'response_code' => $response_code, 'output' => $output );    
+    
+    }
+
     
 }

wp-issues-crm/trunk/php/entity/class-wic-entity-email-process.php

@@ -23 +23 @@
     *                                           -- when sweeping, do not reply if template is '|*no_reply*|';
     */
+    
+    
     public static function handle_inbox_action_requests( $dummy_id, $data ) {
 
@@ -338 +340 @@
 
     public static function setup_settings_form() { 
+
         $settings_form_entity = new WIC_Entity_Email_Settings ( 'no_action', '' );
         return array ( 'response_code' => true, 'output' => $settings_form_entity->settings_form() );

wp-issues-crm/trunk/php/entity/class-wic-entity-email-send.php

@@ -461 +461 @@
         }
         // return error if user does not have authority to send -- possible only if security rules changed after was shown list
-        $required_capability = WIC_Admin_Navigation::check_required_capability( 'list_send' ); 
+        $required_capability = WIC_Admin_Access::check_required_capability( 'list_send' ); 
         if ( ! current_user_can( $required_capability ) ) {
             return array ( 'response_code' => false, 'output' => "Contact your site administrator to upgrade your role to allow list sending.");

wp-issues-crm/trunk/php/form/class-wic-form-email-inbox.php

@@ -38 +38 @@
         $menu_list = '<ul class = "wic-page-option-list" >';
         foreach ( $options_array as $option ){
-            if ( $option['value'] == 'inbox-synch' && ! $show_synch_option ) {
+            // limit options 
+            if  (
+                    ( $option['value'] != 'inbox' && ! current_user_can ( WIC_Admin_Access::check_required_capability( 'view_edit_unassigned' ) ) ) ||
+                    ( $option['value'] == 'inbox-synch' && ! $show_synch_option ) 
+                ){
                 continue;
             }
@@ -72 +76 @@
                 '<button class="wic-form-button page-link prev " type="button" value="prev" title = "Previous Page" ><span class="dashicons dashicons-arrow-left"></span></button>' .
                 '<button class="wic-form-button page-link next " type="button" value="next" title = "Next Page" ><span class="dashicons dashicons-arrow-right"></span></button>' .
+                '<button class="wic-form-button" type="button" id="wic-filter-assigned-button" value="filter_assigned" title = "Filter by Assigned" ><span class="dashicons dashicons-admin-users"></span></button>' .
                 $data_array['subject']->form_control() .        
                 '<button class="wic-form-button email-action-button trigger-email-process-button" id="wic-inbox-sweep-button" value="sweep" type="button" title= "Sweep already mapped"><span class="dashicons dashicons-controls-forward"></span></button>' .
@@ -102 +107 @@
     protected static function setup_inbox( &$data_array ) {
         
-        $tabs_array = WIC_Entity_Email_Account::get_tabs();
+        // limit tabs array to assigned read unless user can view_edit_unassigned
+        $tabs_array = current_user_can ( WIC_Admin_Access::check_required_capability( 'view_edit_unassigned' ) ) ? WIC_Entity_Email_Account::get_tabs() : array ( 'Assigned', 'Ready');
+        
+        // set up tab list
         $tab_list = '';
         foreach ( $tabs_array  as $tab ) {
@@ -357 +365 @@
             '<div id = "wic-email-subject-header"> '.
                 '<div id = "wic-message-subject"></div>' .
+                '<button class="wic-form-button email-action-button trigger-email-process-button" id="wic-email-approve-button" type="button" value="approve" title="Reply ready" ><span class="dashicons dashicons-thumbs-down"></span></button>' .
                 '<button class="wic-form-button email-action-button trigger-email-process-button" id="wic-email-delete-button" type="button" value="delete" title="Archive" ><span class="dashicons dashicons-archive"></span></button>' .
                 '<button class="wic-form-button email-action-button trigger-email-process-button" id="wic-email-block-button" type="button" value="block" title = "Archive and block sender" ><span class="dashicons dashicons-warning"></span></button>' .

wp-issues-crm/trunk/php/list/class-wic-list-activity.php

@@ -125 +125 @@
             $buttons .= WIC_List_Parent::search_inspection_button( $wic_query );
             $buttons .= self::reassign_activities_button ( $wic_query, 'activities' );
-            $required_capability = WIC_Admin_Navigation::check_required_capability( 'downloads' ); // downloads
+            $required_capability = WIC_Admin_Access::check_required_capability( 'downloads' ); // downloads
             if (current_user_can( $required_capability ) ) {
                 $buttons .= self::delete_activities_button ( $wic_query, 'activities' );

wp-issues-crm/trunk/php/list/class-wic-list-constituent.php

@@ -90 +90 @@
             $buttons .= WIC_List_Parent::search_inspection_button( $wic_query );
             // show delete button iff user has required capability
-            $required_capability = WIC_Admin_Navigation::check_required_capability( 'downloads' ); // downloads
+            $required_capability = WIC_Admin_Access::check_required_capability( 'downloads' ); // downloads
             if (current_user_can( $required_capability ) ) {
                 $buttons .= $this->constituent_delete_button ( $wic_query );

wp-issues-crm/trunk/php/list/class-wic-list-parent.php

@@ -148 +148 @@
         
         // show no button if does not have required capability
-        $required_capability = WIC_Admin_Navigation::check_required_capability( 'list_send' ); 
+        $required_capability = WIC_Admin_Access::check_required_capability( 'list_send' ); 
         if ( ! current_user_can( $required_capability ) ) {
             return;

wp-issues-crm/trunk/sql/wic_structures.sql

@@ -241 +241 @@
 category varchar(255) NOT NULL,
 extended_message_id varchar(512) NOT NULL,
+inbox_defined_staff bigint(20) NOT NULL,
+inbox_defined_issue bigint(20) NOT NULL,
+inbox_defined_pro_con varchar(255) NOT NULL,
+inbox_defined_reply_text LONGTEXT NOT NULL,
+inbox_defined_reply_is_final tinyint(1) NOT NULL,
 PRIMARY KEY  (ID),
 KEY in_folder (full_folder_string(100),no_longer_in_server_folder),
@@ -249 +254 @@
 KEY account_thread_id_key (account_thread_id(100)),
 KEY extended_message_id_key (extended_message_id(100)),
-KEY from_domain_key (from_domain(100))
+KEY from_domain_key (from_domain(100)),
+KEY staff_final_subject (inbox_defined_staff,inbox_defined_reply_is_final,subject(100))
 ) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4;
 CREATE TABLE wp_wic_inbox_image_attachments (

wp-issues-crm/trunk/wp-issues-crm.php

@@ -36 +36 @@
 *
 */
+
 // set database version global;
 global $wp_issues_crm_db_version;
-$wp_issues_crm_db_version = '4.4.0'; 
+$wp_issues_crm_db_version = '4.5.0.0.0.1'; 
 /*
 * set js_css version global -- three possibilities: