How to set permissions in php in Bitrix24 - read only, for contacts, for a specific user?

Question

Bitrix24

Bitrix24 Box

How to set permissions on php in Bitrix24 - read only, for contacts, for a specific user?

Answer 1

Bitrix24 mechanics are more complicated than you described.
The matter is that you do not assign the specific rights to the specific user.
So where do you start?
There are users in Bitrix, each user is endowed with a certain number of "Access codes" (AC for short, sometimes they are called roles, general roles, access codes, user codes, etc.). AC in a special case if a combination of letters and numbers, for example U1 - means user ID:1, G2 - the user belongs to the group ID:2, etc.
One user may have many of these attributes.
Bitrix24 is an add-on to the platform, the fundamental module, along with CRM, is the Intranet, which provides the organizational structure. This adds the new code IU123, where IU - stands for Intranet User (employee) ID:123 (i.e. user with ID123, which is in the org chart), D1 which stands for Department 1 (subdivision with ID:1, i.e. i.e. a user who is in the ID:1 department) and DR1 (Department recurcive, a nested department in ID:1 or a user who is in the organizational structure and is nested in the ID:1 department)
Now let's talk about CRM.
There are rights in CRM, for example, the right to add deals, the right to read deals, the right to change contacts, etc. Each right has the values ​​"No access", "Own", "Own department", etc. The combination of rights is called a Role (better to say CRM Role to avoid confusion).
Each Access code is assigned its own role.
And the user, accordingly, receives the maximum possible values ​​​​of the rights available to him.
Those. suppose your task is to "Give role ** to employee ID:1", then you need to call CCrmRole and use SetRelation($arRelation)

Answer 2

Is it necessary via php?
It is possible through the CRM settings, Access rights. You create a role "Reading contacts", all entities except Contacts - no access. In the access rights, you select a user or group and assign this role to them.