What Is ACL in JCB?

Joomla Component Builder (JCB) deeply integrates Joomla’s Access Control List (ACL) system — enabling you to define who can see, edit, create, delete, or administer:

• Entire views (Admin, Site, Custom Admin)
• Individual fields within views
• Specific records (items) at runtime

This control is enforced at both the GUI level (in JCB) and the compiled PHP level (in your component), ensuring secure behavior consistent with Joomla’s native architecture.

Where ACL Applies

View-Level ACL

Each view in JCB (Admin, Custom Admin, Site) includes ACL settings where you can configure permissions like:

• Access View
• Create Item
• Edit Item
• Delete Item
• Edit State
• Edit Own

These translate into standard Joomla task-level permission checks in the compiled controller and model classes.

Field-Level ACL

Fields can also carry ACL-based visibility and editability conditions. This includes:

• Show/hide field based on user group
• Make fields read-only for some users
• Hide fields entirely from unauthorized groups

This allows for flexible form tailoring without needing duplicate views.

Item-Level ACL

When you enable Joomla's "access" support in your component, each data item can carry an access level ID (e.g., Public, Registered, Special), letting you:

• Filter listings by access rights
• Control frontend visibility at the item level
• Combine with Joomla menu/view-level ACLs for full frontend protection

JCB also provides view-level logic to automatically add access filters in model getListQuery methods when needed.

How It’s Configured

In the JCB GUI:

• Open any View → Settings tab → Set view-level access rules.
• Open any Component Config → Permissions tab → Set conditional visibility based on user groups.
• Enable ACL-support fields like access, created_by, and checked_out for item-level logic.

Compiled Output Includes:

• Form XML with access rules and filters
• PHP controllers with access checks
• Models that apply access filters to queries
• Template logic for hiding/showing form elements or rows

Use Cases

• Admin-only fields (e.g., workflow status, hidden notes)
• Site views that only show logged-in user’s data
• Components that respect Joomla’s global permission structure
• Role-based dashboards with different views per group

Versioning & Sharing

Like other JCB entities, ACL-enabled views and fields can be:

• Reset to pull upstream permission changes
• Forked and customized for per-project needs
• Exported/imported with ACL settings intact

Conclusion

ACL in JCB allows you to enforce data privacy, editing boundaries, and customized user experiences — all directly from the builder interface. With field-, item-, and view-level controls, you’re free to build secure, scalable Joomla components that respect every user’s role and rights.