Session evaluations need default ratings/question set.

Makes sense to me. We might want to get a review of the text on the labels, but that's a quibble that can be easily fixed later. Also, new component :)

first attempt. Views are still using the nodereference field which causes error.
didn't see #1669970: COD Session evaluation feature to use entity references instead of nodereference_url when I was doing this patch. Can we just combine? It's going to be a prerequisite for this issue too. :D

Works on my end. I tried fixing the "Broken/missing handler" errors in views (mentioned in #2) but I can't seem to get the exposed filter "Session" in conference-admin/sessions/evaluations to work. I'm not sure how to make it search for the title of the referenced session.

trying to fix this, but the after #1669970: COD Session evaluation feature to use entity references instead of nodereference_url was solved the patch above is looking for cod_session_evaluations.views_default.inc which is not in the branch. Here's a patch that establishes the question set on the current branch. No work on the views yet.

missed some field settings in that last one, still working on views.

oh, that's fun, a 0 lenght patch :( re-rolling, and working on views/reporting for evals

Ok, once again…

now onto views/reports for session evals

Also, I had an idea to add session evals as a tab on the session nodes, visible to speakers. Yes/No?

A tab seems a reasonable place for this to me.

Ok, here's the first version of the view, sets up the fields in a table at node/[nid]/session_evals, only lets session speakers see the evaluations. Will be adding a data export, and an admin view with some filters and an export.

Ok, added the data export for the speaker view, added an admin view with exposed filters on session and speaker, and a data export that will export the filtered results.

here's my preliminary work on getting the tab set up.

So far it displays the tab on sessions. I am still figuring out how to add the nid to the path of the tab, and then some logic is needed to check the current user's ID vs. the IDs of the speakers.

crap, disregard, need to re-roll that one

alright, this looks better now :)

So, turns out you can add the tab to nodes in the view, but I cannot find a way (in views) to limit showing the tab based on the user. Maybe hook_menu_alter with a custom function that checks? I'm going to see where that takes me, open to other ideas though.

Ok, so another discovery, Views does not implement hook_menu to generate it's menu items, thus hook_menu_alter will not function. I think now I'm going to embed the view in a custom pag (views_embed_view)

Ok, here's some more work, had to go the route of putting the view output into a custom page, have logic for hiding the tab from users who are not the speaker of a session. Having a problem with a memory error though, perhaps someone can help track that one down.

Sorry, the memory error is occurring when I click the tab to view the evals

so, using menu_get_object inside of my access callback was causing the memory problem, it was being triggered almost endlessly. Here's one that uses node_load instead (for checking speaker IDs)

Please review.

Had a few stray items in the code, this is cleaner.

+function cod_session_evaluations_menu(){
+  $items['node/%node/evaluations'] = array(
+    'title' => 'Session Evals',
+    'type' => MENU_LOCAL_TASK,
+    'page callback' => 'cod_session_evaluations_page',
+    'access callback' => 'cod_session_evaluations_speaker_access',
+  );
+  return $items;
+}

+function cod_session_evaluations_speaker_access() {
+  global $user;
+  $node = node_load(arg(1));
+  $speakerids = $node->field_speakers['und'];
+  foreach ($speakerids as $speakerid) {
+    if ($user->uid == $speakerid['target_id']) {
+      return TRUE;
+    }
+  }
+  return FALSE;
+}

I think if you change function cod_session_evaluations_speaker_access() to function cod_session_evaluations_speaker_access($node) and adding 'access arguments' => array(1) on "node/%node/evaluations", you don't need to do a node_load since the node is already loaded via "%node".

Soon as I do that I get an error that the argument is missing

my bad, forgot to clear the menu cache, I think that method is working, going to test it a bit further.

Also, just noticed something else, when I am using the $view->preview() method to embed the view on the page, I am losing the CSV button for the data export :\

Ok, updated.

I'm a little confused of the way the view works for cod_session_evals. I have 2 users - admin and dummy, and have this scenario:

1. dummy creates a new session
2. dummy and admin provides feedback
3. dummy goes to node/[session_nid]/evaluations and sees his evaluations
4. admin goes to node/[session_nid]/evaluations and sees his evaluations

Is this the expected output? Or shouldn't dummy be able to see all the evaluations?

Was getting an error saying Notice: Undefined property: stdClass::$field_speakers in cod_session_evaluations_speaker_access()... . Got it working with this:

function cod_session_evaluations_speaker_access($node) {
  global $user;

  $type = 'session';
  if ($node->type == $type) {
    $field = 'field_speakers';
    $items = field_get_items('node', $node, $field);
    foreach ($items as $item) {
      if ($user->uid == $item['target_id']) {
        return TRUE;
      }
    }
  }

  return FALSE;
}

+  $view = views_get_view('cod_session_evals');
+  return array('#markup' => $view->preview('speaker_evals_page'));

I think this can be changed to return array('#markup' => views_embed_view('cod_session_evals', 'speakers_evals_page')); so it respects views access as well.

Ok, so another discovery, Views does not implement hook_menu to generate it's menu items, thus hook_menu_alter will not function.

It implements hook_menu_alter though so I think hook_menu_alter should still work but the module altering views' menu items should have higher weight than the views module.

I though views_embed_view had to be done at the theme layer?

hook_menu_alter does not work against the menu item generated by views, I spent quite a while working on that.

I'm not seeing that error though, think I'll blow out my dev site and start fresh with just the patch.

ok, views_embed_view worked to get it on the page, but still no CSV button :(

Not being able to see all the evals was coming from some over-enthusiastic permissions on the fields of the eval, so I freed them up a bit. I also added a hook_node_access which prohibits any user from viewing a session eval.

status update

Added the csv button on the evals page.

Also, how can we keep session evals from being indexed by search?

re #32 - if the function cod_session_evaluations_node_access function works properly then search will be handled by core's search functionality.

Well, they can't access the nodes, but the title and teaser still show in the search results.

Per an IRC convo with greggles, the content_access module can do this for us no problem, just need to have no permissions for viewing on the content type, then it does not show in the search, and they are not allowed access to any of those nodes. :)

BUT, then the speakers cannot even see the values of the session evals in the view :\

So is this needs work to get content_access installed/configured as part of the install?

Another attempt. Patch specifically alters the search results through a template preprocess. Not sure if this is a good way but I can't find a way to alter the search results based on node access. There doesn't seem to be any hooks for altering the search results as well. Altering the query might work with hook_query_node_access_alter I think but I dunno what to alter in the query. xD

I also see this in #29:

 * No user (admin or otherwise) should be able to see a session_evaluation
 * node, this is a privacy issue.

hook_node_access is bypassed on certain permissions when I tried e.g. the hook is bypassed when the current user is user 1. Not sure how to handle this if session evaluations are totally inaccessible.

yeah, I don't think we need to be concerned with users that are that high up the food-chain.

Hi,

So what should be done here?

Thanks!

This still needs work per greggles comment in #37.

A) The patch in #38 uses a pre-process hook to hide session evaluations from users who shouldn't be able to see them. Preprocess is not a substitue for the node access system. The current cod_session_evaluation module includes the content_access module, and as greggles points out we need to provide default configuration for that module, or implement another solution through the node access system to ensure that session evaluation nodes are restricted from users other than session organizers, the author of the session node, and ideally (but not necessarily) all referenced speaker users on the related session.

Not sure if this is a good way but I can't find a way to alter the search results based on node access

In general, the node access system when implemented correctly will hide nodes from being displayed in any site context, including search.

Drupal's node access system is documented at:
http://api.drupal.org/api/drupal/modules%21node%21node.module/group/node....

Another option would be to extend http://drupal.org/project/nodeaccess_userreference to take into account the users in the referenced session node.

B) #38 introduces a dependency on http://drupal.org/project/list, which is a Drupal 6 only module as far as I can tell and saw its last commit 3 years ago. Is there a reason Fivestar isn't sufficient here?

C) #38 introduces a new custom callback: node/%node/evaluations that embeds a view. Is there a reason not to have the view hide/deny access when empty? That would provide the tab in a more flexible way without introducing new custom code.

D) #38 implements hook_node_access() but appears to restrict access to session evaluations from all users. This seems unintentional:

+/**
+ * Implements hook_node_access
+ * No user (admin or otherwise) should be able to see a session_evaluation
+ * node, this is a privacy issue.
+ */
+function cod_session_evaluations_node_access($node, $op, $account) {
+  if ($op == 'view' && $node->type == 'session_evaluation') {
+    watchdog('node_access', 'triggered', NULL);
+    return NODE_ACCESS_DENY;
+  }
+}

E) Less critical and not blocking to this issue: It would be ideal to export the questions in a separate feature (such as cod_session_evaluation_defaults) to make it easy for sites with different sets of questions to re-use the configuration provided by cod_session_evaluations without having overidden features.

Hi,

A) Yeah, I'm having a little trouble with getting it to work. hook_node_access doesn't seem to be the way to go when checking node access in a listing e.g. search.

C) For this one, what I was able to come up with is setting "Specify validation criteria" to "Validator": "PHP Code" and just copied what was inside the cod_session_evaluations_speaker_access() function from the patch above. Not sure if this is the right way but it works.

updated table desc