I have a plugin that provisions access to sites for existing Matomo users. It has been working really well for those that already have access to at least 1 site. I am unsure how to implement it to support users with no current site access. I implemented the plugin as a controller action. It looks like users without at least read access to 1 site are forbidden to execute actions on the plugin as they get the no access error. Any tips? This is the plugin https://github.com/jbrule/matomoplugin-SiteAccessProvisioner.
Looks like Matomo’s permission checks are blocking users with no site access. You can bypass this using @NoAccessRequired and handle access inside your plugin instead. Also check how core plugins manage global permissions for similar cases.
From what you’ve described, it sounds like the permission check is happening before your controller action is reached. Users with no site access are often treated differently because Matomo assumes they shouldn’t be able to access most plugin pages.
One approach might be to make the provisioning action available through an admin-only endpoint or a system-level permission instead of relying on site-level access. That way, the action can grant the initial site permissions before the user is expected to have access to any reports.
If the plugin is intended for self-service by users with no existing permissions, you may need to review the controller’s required permissions or whether a different controller type/API endpoint would be more appropriate. It would also help to know whether the action is meant to be triggered by a Super User, an admin, or the end user themselves, since that changes the best approach.
Users with no site permissions are blocked before your controller action runs. A common solution is to perform provisioning through an admin-only action, API endpoint, or event hook that doesn’t require the target user to already have site access. Granting minimal access first can also work if it fits your workflow.