Fix detection of the layer id.

composer.json

@@ -42,7 +42,8 @@
     "netzmacht/contao-page-context": "~1.0",
     "contao-community-alliance/meta-palettes": "^2.0 || ^1.5",
     "menatwork/contao-multicolumnwizard": "^3.2",
-    "doctrine/cache": "^1.0"
+    "doctrine/cache": "^1.0",
+    "codefog/contao-widget_tree_picker": "^2.4"
   },
   "require-dev": {
     "phpcq/all-tasks": "^1.2",

src/Bundle/Resources/config/listeners.yml

@@ -51,6 +51,8 @@ services:
       - '@netzmacht.contao_toolkit.repository_manager'
       - '@translator'
       - '@netzmacht.contao_leaflet.layer_label_renderer'
+      - '@netzmacht.contao_toolkit.contao.backend_user'
+      - '@netzmacht.contao_toolkit.dca.listeners.state_button_callback'
       - '@netzmacht.contao_toolkit.contao.backend_adapter'
       - '%netzmacht.contao_leaflet.layers%'
       - '%netzmacht.contao_leaflet.providers%'
@@ -63,6 +65,7 @@ services:
     arguments:
       - '@database_connection'
       - '@netzmacht.contao_toolkit.repository_manager'
+      - '@netzmacht.contao_toolkit.contao.backend_user'
 
   netzmacht.contao_leaflet.listeners.dca.vector:
     class: Netzmacht\Contao\Leaflet\Listener\Dca\VectorDcaListener
@@ -70,20 +73,52 @@ services:
     arguments:
       - '@netzmacht.contao_toolkit.dca.manager'
       - '@netzmacht.contao_toolkit.repository_manager'
+      - '@netzmacht.contao_toolkit.contao.backend_user'
       - '%netzmacht.contao_leaflet.vectors%'
 
   netzmacht.contao_leaflet.listeners.dca.icon:
     class: Netzmacht\Contao\Leaflet\Listener\Dca\IconDcaListener
     public: true
     arguments:
+      - '@netzmacht.contao_toolkit.contao.backend_user'
       - '%netzmacht.contao_leaflet.icons%'
 
   netzmacht.contao_leaflet.listeners.dca.style:
     class: Netzmacht\Contao\Leaflet\Listener\Dca\StyleDcaListener
     public: true
     arguments:
+      - '@netzmacht.contao_toolkit.contao.backend_user'
       - '%netzmacht.contao_leaflet.styles%'
 
+  netzmacht.contao_leaflet.listeners.dca.popup:
+    class: Netzmacht\Contao\Leaflet\Listener\Dca\PopupDcaListener
+    public: true
+    arguments:
+      - '@netzmacht.contao_toolkit.contao.backend_user'
+
+  netzmacht.contao_leaflet.listeners.dca.user:
+    class: Netzmacht\Contao\Leaflet\Listener\Dca\UserDcaListener
+    public: true
+    arguments:
+      - '@netzmacht.contao_toolkit.dca.manager'
+      - '@netzmacht.contao_leaflet.layer_label_renderer'
+      - '@translator'
+      - '%netzmacht.contao_leaflet.layers%'
+      -
+  netzmacht.contao_leaflet.listeners.dca.user_group:
+    class: Netzmacht\Contao\Leaflet\Listener\Dca\UserGroupDcaListener
+    public: true
+    arguments:
+      - '@netzmacht.contao_toolkit.dca.manager'
+      - '@netzmacht.contao_leaflet.layer_label_renderer'
+      - '@translator'
+      - '%netzmacht.contao_leaflet.layers%'
+
+  Netzmacht\Contao\Leaflet\Listener\Dca\OperationsListener:
+    public: true
+    arguments:
+      - '@netzmacht.contao_toolkit.contao.backend_user'
+
   netzmacht.contao_leaflet.listeners.geo_json_listener:
     class: Netzmacht\Contao\Leaflet\Listener\GeoJsonListener
     arguments:

src/Bundle/Resources/contao/config/config.php

@@ -11,7 +11,7 @@
  */
 
 /*
- * Backend module.
+ * Backend modules
  */
 
 array_insert(
@@ -48,8 +48,9 @@ if (TL_MODE === 'BE') {
     $GLOBALS['TL_CSS'][] = 'bundles/netzmachtcontaoleaflet/css/backend_global.css';
 }
 
+
 /*
- * Models.
+ * Models
  */
 
 $GLOBALS['TL_MODELS']['tl_leaflet_control'] = \Netzmacht\Contao\Leaflet\Model\ControlModel::class;
@@ -60,3 +61,12 @@ $GLOBALS['TL_MODELS']['tl_leaflet_marker']  = \Netzmacht\Contao\Leaflet\Model\Ma
 $GLOBALS['TL_MODELS']['tl_leaflet_popup']   = \Netzmacht\Contao\Leaflet\Model\PopupModel::class;
 $GLOBALS['TL_MODELS']['tl_leaflet_style']   = \Netzmacht\Contao\Leaflet\Model\StyleModel::class;
 $GLOBALS['TL_MODELS']['tl_leaflet_vector']  = \Netzmacht\Contao\Leaflet\Model\VectorModel::class;
+
+
+/*
+ * Permissions
+ */
+
+$GLOBALS['TL_PERMISSIONS'][] = 'leaflet_layers';
+$GLOBALS['TL_PERMISSIONS'][] = 'leaflet_layer_permissions';
+$GLOBALS['TL_PERMISSIONS'][] = 'leaflet_tables';

src/Bundle/Resources/contao/dca/tl_leaflet_icon.php

@@ -10,6 +10,8 @@
  * @filesource
  */
 
+use Netzmacht\Contao\Leaflet\Listener\Dca\OperationsListener;
+
 $GLOBALS['TL_DCA']['tl_leaflet_icon'] = [
     'config' => [
         'dataContainer'     => 'Table',
@@ -20,6 +22,9 @@ $GLOBALS['TL_DCA']['tl_leaflet_icon'] = [
                 'alias' => 'unique',
             ],
         ],
+        'onload_callback'   => [
+            ['netzmacht.contao_leaflet.listeners.dca.icon', 'checkPermission'],
+        ],
         'onsubmit_callback' => [
             ['netzmacht.contao_leaflet.listeners.dca.leaflet', 'clearCache'],
         ],
@@ -45,16 +50,19 @@ $GLOBALS['TL_DCA']['tl_leaflet_icon'] = [
                 'attributes' => 'onclick="Backend.getScrollOffset();" accesskey="e"',
             ],
             'styles' => [
-                'label'      => &$GLOBALS['TL_LANG']['tl_leaflet_icon']['styles'],
-                'href'       => 'table=tl_leaflet_style',
-                'icon'       => 'bundles/netzmachtcontaoleaflet/img/style.png',
-                'attributes' => 'onclick="Backend.getScrollOffset();"',
+                'label'           => &$GLOBALS['TL_LANG']['tl_leaflet_icon']['styles'],
+                'href'            => 'table=tl_leaflet_style',
+                'icon'            => 'bundles/netzmachtcontaoleaflet/img/style.png',
+                'attributes'      => 'onclick="Backend.getScrollOffset();"',
+                'button_callback' => [OperationsListener::class, 'styleOperation'],
+
             ],
             'popups' => [
-                'label'      => &$GLOBALS['TL_LANG']['tl_leaflet_icon']['popups'],
-                'href'       => 'table=tl_leaflet_popup',
-                'icon'       => 'bundles/netzmachtcontaoleaflet/img/popup.png',
-                'attributes' => 'onclick="Backend.getScrollOffset();"',
+                'label'           => &$GLOBALS['TL_LANG']['tl_leaflet_icon']['popups'],
+                'href'            => 'table=tl_leaflet_popup',
+                'icon'            => 'bundles/netzmachtcontaoleaflet/img/popup.png',
+                'attributes'      => 'onclick="Backend.getScrollOffset();"',
+                'button_callback' => [OperationsListener::class, 'popupOperation'],
             ],
             'all'    => [
                 'label'      => &$GLOBALS['TL_LANG']['MSC']['all'],

src/Bundle/Resources/contao/dca/tl_leaflet_layer.php

@@ -10,14 +10,13 @@
  * @filesource
  */
 
+use Netzmacht\Contao\Leaflet\Listener\Dca\OperationsListener;
+
 $GLOBALS['TL_DCA']['tl_leaflet_layer'] = [
     'config' => [
         'dataContainer'     => 'Table',
         'enableVersioning'  => true,
         'ctable'            => ['tl_leaflet_vector', 'tl_leaflet_marker'],
-        'ondelete_callback' => [
-            ['netzmacht.contao_leaflet.listeners.dca.layer', 'deleteRelations'],
-        ],
         'sql'               => [
             'keys' => [
                 'id'    => 'primary',
@@ -26,8 +25,12 @@ $GLOBALS['TL_DCA']['tl_leaflet_layer'] = [
             ],
         ],
         'onload_callback'   => [
+            ['netzmacht.contao_leaflet.listeners.dca.layer', 'checkPermissions'],
             ['netzmacht.contao_leaflet.listeners.dca.leaflet', 'loadLanguageFile'],
         ],
+        'ondelete_callback' => [
+            ['netzmacht.contao_leaflet.listeners.dca.layer', 'deleteRelations'],
+        ],
         'onsubmit_callback' => [
             ['netzmacht.contao_leaflet.listeners.dca.leaflet', 'clearCache'],
         ],
@@ -48,22 +51,25 @@ $GLOBALS['TL_DCA']['tl_leaflet_layer'] = [
         ],
         'global_operations' => [
             'styles' => [
-                'label'      => &$GLOBALS['TL_LANG']['tl_leaflet_layer']['styles'],
-                'href'       => 'table=tl_leaflet_style',
-                'icon'       => 'bundles/netzmachtcontaoleaflet/img/style.png',
-                'attributes' => 'onclick="Backend.getScrollOffset();"',
+                'label'           => &$GLOBALS['TL_LANG']['tl_leaflet_layer']['styles'],
+                'href'            => 'table=tl_leaflet_style',
+                'icon'            => 'bundles/netzmachtcontaoleaflet/img/style.png',
+                'attributes'      => 'onclick="Backend.getScrollOffset();"',
+                'button_callback' => [OperationsListener::class, 'styleOperation'],
             ],
             'icons'  => [
-                'label'      => &$GLOBALS['TL_LANG']['tl_leaflet_layer']['icons'],
-                'href'       => 'table=tl_leaflet_icon',
-                'icon'       => 'bundles/netzmachtcontaoleaflet/img/icons.png',
-                'attributes' => 'onclick="Backend.getScrollOffset();"',
+                'label'           => &$GLOBALS['TL_LANG']['tl_leaflet_layer']['icons'],
+                'href'            => 'table=tl_leaflet_icon',
+                'icon'            => 'bundles/netzmachtcontaoleaflet/img/icons.png',
+                'attributes'      => 'onclick="Backend.getScrollOffset();"',
+                'button_callback' => [OperationsListener::class, 'iconOperation'],
             ],
             'popups' => [
-                'label'      => &$GLOBALS['TL_LANG']['tl_leaflet_layer']['popups'],
-                'href'       => 'table=tl_leaflet_popup',
-                'icon'       => 'bundles/netzmachtcontaoleaflet/img/popup.png',
-                'attributes' => 'onclick="Backend.getScrollOffset();"',
+                'label'           => &$GLOBALS['TL_LANG']['tl_leaflet_layer']['popups'],
+                'href'            => 'table=tl_leaflet_popup',
+                'icon'            => 'bundles/netzmachtcontaoleaflet/img/popup.png',
+                'attributes'      => 'onclick="Backend.getScrollOffset();"',
+                'button_callback' => [OperationsListener::class, 'popupOperation'],
             ],
             'all'    => [
                 'label'      => &$GLOBALS['TL_LANG']['MSC']['all'],
@@ -86,27 +92,31 @@ $GLOBALS['TL_DCA']['tl_leaflet_layer'] = [
                 'button_callback' => ['netzmacht.contao_leaflet.listeners.dca.layer', 'generateVectorsButton'],
             ],
             'edit'    => [
-                'label' => &$GLOBALS['TL_LANG']['tl_leaflet_layer']['edit'],
-                'href'  => 'act=edit',
-                'icon'  => 'header.gif',
+                'label'           => &$GLOBALS['TL_LANG']['tl_leaflet_layer']['edit'],
+                'href'            => 'act=edit',
+                'icon'            => 'header.gif',
+                'button_callback' => ['netzmacht.contao_leaflet.listeners.dca.layer', 'generateEditButton'],
             ],
             'copy'    => [
-                'label' => &$GLOBALS['TL_LANG']['tl_leaflet_layer']['copy'],
-                'href'  => 'act=copy',
-                'icon'  => 'copy.gif',
+                'label'           => &$GLOBALS['TL_LANG']['tl_leaflet_layer']['copy'],
+                'href'            => 'act=copy',
+                'icon'            => 'copy.gif',
+                'button_callback' => ['netzmacht.contao_leaflet.listeners.dca.layer', 'generateCopyButton'],
             ],
             'cut'     => [
                 'label'      => &$GLOBALS['TL_LANG']['tl_leaflet_layer']['cut'],
                 'href'       => 'act=paste&mode=cut',
                 'icon'       => 'cut.gif',
                 'attributes' => 'onclick="Backend.getScrollOffset()"',
+                'button_callback' => ['netzmacht.contao_leaflet.listeners.dca.layer', 'generateEditButton'],
             ],
             'delete'  => [
-                'label'      => &$GLOBALS['TL_LANG']['tl_leaflet_layer']['delete'],
-                'href'       => 'act=delete',
-                'icon'       => 'delete.gif',
-                'attributes' => 'onclick="if(!confirm(\'' . $GLOBALS['TL_LANG']['MSC']['deleteConfirm']
+                'label'           => &$GLOBALS['TL_LANG']['tl_leaflet_layer']['delete'],
+                'href'            => 'act=delete',
+                'icon'            => 'delete.gif',
+                'attributes'      => 'onclick="if(!confirm(\'' . $GLOBALS['TL_LANG']['MSC']['deleteConfirm']
                     . '\'))return false;Backend.getScrollOffset()"',
+                'button_callback' => ['netzmacht.contao_leaflet.listeners.dca.layer', 'generateDeleteButton'],
             ],
             'toggle'  => [
                 'label'           => &$GLOBALS['TL_LANG']['tl_leaflet_layer']['toggle'],
@@ -114,8 +124,8 @@ $GLOBALS['TL_DCA']['tl_leaflet_layer'] = [
                 'attributes'      => 'onclick="Backend.getScrollOffset(); 
                     return ContaoLeafletAjaxRequest.toggleVisibility(this,%s)"',
                 'button_callback' => [
-                    'netzmacht.contao_toolkit.dca.listeners.state_button_callback',
-                    'handleButtonCallback',
+                    'netzmacht.contao_leaflet.listeners.dca.layer',
+                    'generateToggleButton',
                 ],
                 'toolkit'         => [
                     'state_button' => [
@@ -235,9 +245,9 @@ $GLOBALS['TL_DCA']['tl_leaflet_layer'] = [
             'MapBox' => ['tile_provider_key'],
             'HERE'   => ['tile_provider_key', 'tile_provider_code'],
         ],
-        'fileFormat' => [
-            '!' => ['file']
-        ]
+        'fileFormat'    => [
+            '!' => ['file'],
+        ],
     ],
 
     'metasubpalettes' => [
@@ -864,7 +874,7 @@ $GLOBALS['TL_DCA']['tl_leaflet_layer'] = [
             ],
             'sql'       => 'mediumtext NULL',
         ],
-        'fileFormat' => [
+        'fileFormat'                     => [
             'label'            => &$GLOBALS['TL_LANG']['tl_leaflet_layer']['fileFormat'],
             'exclude'          => true,
             'inputType'        => 'select',
@@ -882,19 +892,19 @@ $GLOBALS['TL_DCA']['tl_leaflet_layer'] = [
             'sql'              => "varchar(32) NOT NULL default ''",
         ],
         'file'                           => [
-            'label'     => &$GLOBALS['TL_LANG']['tl_leaflet_layer']['file'],
-            'exclude'   => true,
-            'inputType' => 'fileTree',
+            'label'         => &$GLOBALS['TL_LANG']['tl_leaflet_layer']['file'],
+            'exclude'       => true,
+            'inputType'     => 'fileTree',
             'load_callback' => [
                 ['netzmacht.contao_leaflet.listeners.dca.layer', 'prepareFileWidget'],
             ],
-            'eval'      => [
-                'filesOnly'  => true,
-                'fieldType'  => 'radio',
-                'mandatory'  => true,
-                'tl_class'   => 'clr',
+            'eval'          => [
+                'filesOnly' => true,
+                'fieldType' => 'radio',
+                'mandatory' => true,
+                'tl_class'  => 'clr',
             ],
-            'sql'       => 'binary(16) NULL',
+            'sql'           => 'binary(16) NULL',
         ],
     ],
 ];

src/Bundle/Resources/contao/dca/tl_leaflet_marker.php

@@ -10,6 +10,8 @@
  * @filesource
  */
 
+use Netzmacht\Contao\Leaflet\Listener\Dca\OperationsListener;
+
 $GLOBALS['TL_DCA']['tl_leaflet_marker'] = [
     'config' => [
         'dataContainer'     => 'Table',
@@ -23,6 +25,7 @@ $GLOBALS['TL_DCA']['tl_leaflet_marker'] = [
             ],
         ],
         'onload_callback'   => [
+            ['netzmacht.contao_leaflet.listeners.dca.marker', 'checkPermissions'],
             ['netzmacht.contao_leaflet.listeners.dca.leaflet', 'loadLanguageFile'],
         ],
         'onsubmit_callback' => [
@@ -45,16 +48,18 @@ $GLOBALS['TL_DCA']['tl_leaflet_marker'] = [
         ],
         'global_operations' => [
             'icons'  => [
-                'label'      => &$GLOBALS['TL_LANG']['tl_leaflet_marker']['icons'],
-                'href'       => 'table=tl_leaflet_icon&id=',
-                'icon'       => 'bundles/netzmachtcontaoleaflet/img/icons.png',
-                'attributes' => 'onclick="Backend.getScrollOffset();" accesskey="e"',
+                'label'           => &$GLOBALS['TL_LANG']['tl_leaflet_marker']['icons'],
+                'href'            => 'table=tl_leaflet_icon&id=',
+                'icon'            => 'bundles/netzmachtcontaoleaflet/img/icons.png',
+                'attributes'      => 'onclick="Backend.getScrollOffset();" accesskey="e"',
+                'button_callback' => [OperationsListener::class, 'iconOperation'],
             ],
             'popups' => [
-                'label'      => &$GLOBALS['TL_LANG']['tl_leaflet_marker']['popups'],
-                'href'       => 'table=tl_leaflet_popup',
-                'icon'       => 'bundles/netzmachtcontaoleaflet/img/popup.png',
-                'attributes' => 'onclick="Backend.getScrollOffset();"',
+                'label'           => &$GLOBALS['TL_LANG']['tl_leaflet_marker']['popups'],
+                'href'            => 'table=tl_leaflet_popup',
+                'icon'            => 'bundles/netzmachtcontaoleaflet/img/popup.png',
+                'attributes'      => 'onclick="Backend.getScrollOffset();"',
+                'button_callback' => [OperationsListener::class, 'popupOperation'],
             ],
             'all'    => [
                 'label'      => &$GLOBALS['TL_LANG']['MSC']['all'],

src/Bundle/Resources/contao/dca/tl_leaflet_popup.php

@@ -10,6 +10,8 @@
  * @filesource
  */
 
+use Netzmacht\Contao\Leaflet\Listener\Dca\OperationsListener;
+
 $GLOBALS['TL_DCA']['tl_leaflet_popup'] = [
     'config' => [
         'dataContainer'     => 'Table',
@@ -20,6 +22,9 @@ $GLOBALS['TL_DCA']['tl_leaflet_popup'] = [
                 'alias' => 'unique',
             ],
         ],
+        'onload_callback'   => [
+            ['netzmacht.contao_leaflet.listeners.dca.popup', 'checkPermission'],
+        ],
         'onsubmit_callback' => [
             ['netzmacht.contao_leaflet.listeners.dca.leaflet', 'clearCache'],
         ],
@@ -45,16 +50,18 @@ $GLOBALS['TL_DCA']['tl_leaflet_popup'] = [
                 'attributes' => 'onclick="Backend.getScrollOffset();" accesskey="e"',
             ],
             'styles' => [
-                'label'      => &$GLOBALS['TL_LANG']['tl_leaflet_popup']['styles'],
-                'href'       => 'table=tl_leaflet_style',
-                'icon'       => 'bundles/netzmachtcontaoleaflet/img/style.png',
-                'attributes' => 'onclick="Backend.getScrollOffset();"',
+                'label'           => &$GLOBALS['TL_LANG']['tl_leaflet_popup']['styles'],
+                'href'            => 'table=tl_leaflet_style',
+                'icon'            => 'bundles/netzmachtcontaoleaflet/img/style.png',
+                'attributes'      => 'onclick="Backend.getScrollOffset();"',
+                'button_callback' => [OperationsListener::class, 'styleOperation'],
             ],
             'icons'  => [
-                'label'      => &$GLOBALS['TL_LANG']['tl_leaflet_popup']['icons'],
-                'href'       => 'table=tl_leaflet_icon',
-                'icon'       => 'bundles/netzmachtcontaoleaflet/img/icons.png',
-                'attributes' => 'onclick="Backend.getScrollOffset();"',
+                'label'           => &$GLOBALS['TL_LANG']['tl_leaflet_popup']['icons'],
+                'href'            => 'table=tl_leaflet_icon',
+                'icon'            => 'bundles/netzmachtcontaoleaflet/img/icons.png',
+                'attributes'      => 'onclick="Backend.getScrollOffset();"',
+                'button_callback' => [OperationsListener::class, 'iconOperation'],
             ],
             'all'    => [
                 'label'      => &$GLOBALS['TL_LANG']['MSC']['all'],

src/Bundle/Resources/contao/dca/tl_leaflet_style.php

@@ -10,6 +10,8 @@
  * @filesource
  */
 
+use Netzmacht\Contao\Leaflet\Listener\Dca\OperationsListener;
+
 $GLOBALS['TL_DCA']['tl_leaflet_style'] = [
     'config' => [
         'dataContainer'     => 'Table',
@@ -20,6 +22,9 @@ $GLOBALS['TL_DCA']['tl_leaflet_style'] = [
                 'alias' => 'unique',
             ],
         ],
+        'onload_callback'   => [
+            ['netzmacht.contao_leaflet.listeners.dca.style', 'checkPermission'],
+        ],
         'onsubmit_callback' => [
             ['netzmacht.contao_leaflet.listeners.dca.leaflet', 'clearCache'],
         ],
@@ -45,16 +50,18 @@ $GLOBALS['TL_DCA']['tl_leaflet_style'] = [
                 'attributes' => 'onclick="Backend.getScrollOffset();" accesskey="e"',
             ],
             'icons'  => [
-                'label'      => &$GLOBALS['TL_LANG']['tl_leaflet_style']['icons'],
-                'href'       => 'table=tl_leaflet_icon',
-                'icon'       => 'bundles/netzmachtcontaoleaflet/img/icons.png',
-                'attributes' => 'onclick="Backend.getScrollOffset();"',
+                'label'           => &$GLOBALS['TL_LANG']['tl_leaflet_style']['icons'],
+                'href'            => 'table=tl_leaflet_icon',
+                'icon'            => 'bundles/netzmachtcontaoleaflet/img/icons.png',
+                'attributes'      => 'onclick="Backend.getScrollOffset();"',
+                'button_callback' => [OperationsListener::class, 'iconOperation'],
             ],
             'popups' => [
-                'label'      => &$GLOBALS['TL_LANG']['tl_leaflet_style']['popups'],
-                'href'       => 'table=tl_leaflet_popup',
-                'icon'       => 'bundles/netzmachtcontaoleaflet/img/popup.png',
-                'attributes' => 'onclick="Backend.getScrollOffset();"',
+                'label'           => &$GLOBALS['TL_LANG']['tl_leaflet_style']['popups'],
+                'href'            => 'table=tl_leaflet_popup',
+                'icon'            => 'bundles/netzmachtcontaoleaflet/img/popup.png',
+                'attributes'      => 'onclick="Backend.getScrollOffset();"',
+                'button_callback' => [OperationsListener::class, 'popupOperation'],
             ],
             'all'    => [
                 'label'      => &$GLOBALS['TL_LANG']['MSC']['all'],

src/Bundle/Resources/contao/dca/tl_leaflet_vector.php

@@ -10,6 +10,8 @@
  * @filesource
  */
 
+use Netzmacht\Contao\Leaflet\Listener\Dca\OperationsListener;
+
 $GLOBALS['TL_DCA']['tl_leaflet_vector'] = [
     'config' => [
         'dataContainer'     => 'Table',
@@ -45,16 +47,18 @@ $GLOBALS['TL_DCA']['tl_leaflet_vector'] = [
         ],
         'global_operations' => [
             'styles' => [
-                'label'      => &$GLOBALS['TL_LANG']['tl_leaflet_vector']['styles'],
-                'href'       => 'table=tl_leaflet_style',
-                'icon'       => 'bundles/netzmachtcontaoleaflet/img/style.png',
-                'attributes' => 'onclick="Backend.getScrollOffset();"',
+                'label'           => &$GLOBALS['TL_LANG']['tl_leaflet_vector']['styles'],
+                'href'            => 'table=tl_leaflet_style',
+                'icon'            => 'bundles/netzmachtcontaoleaflet/img/style.png',
+                'attributes'      => 'onclick="Backend.getScrollOffset();"',
+                'button_callback' => [OperationsListener::class, 'styleOperation'],
             ],
             'popups' => [
-                'label'      => &$GLOBALS['TL_LANG']['tl_leaflet_vector']['popups'],
-                'href'       => 'table=tl_leaflet_popup',
-                'icon'       => 'bundles/netzmachtcontaoleaflet/img/popup.png',
-                'attributes' => 'onclick="Backend.getScrollOffset();"',
+                'label'           => &$GLOBALS['TL_LANG']['tl_leaflet_vector']['popups'],
+                'href'            => 'table=tl_leaflet_popup',
+                'icon'            => 'bundles/netzmachtcontaoleaflet/img/popup.png',
+                'attributes'      => 'onclick="Backend.getScrollOffset();"',
+                'button_callback' => [OperationsListener::class, 'popupOperation'],
             ],
             'all'    => [
                 'label'      => &$GLOBALS['TL_LANG']['MSC']['all'],

src/Bundle/Resources/contao/dca/tl_user.php

@@ -0,0 +1,68 @@
+<?php
+
+/**
+ * Leaflet maps for Contao CMS.
+ *
+ * @package    contao-leaflet-maps
+ * @author     David Molineus <david.molineus@netzmacht.de>
+ * @copyright  2014-2018 netzmacht David Molineus. All rights reserved.
+ * @license    LGPL-3.0 https://github.com/netzmacht/contao-leaflet-maps/blob/master/LICENSE
+ * @filesource
+ */
+
+declare(strict_types=1);
+
+use Contao\CoreBundle\DataContainer\PaletteManipulator;
+
+PaletteManipulator::create()
+    ->addLegend('leaflet_legend', 'amg_legend', PaletteManipulator::POSITION_BEFORE)
+    ->addField(
+        ['leaflet_layers', 'leaflet_layer_permissions', 'leaflet_tables'],
+        'leaflet_legend',
+        PaletteManipulator::POSITION_APPEND
+    )
+    ->applyToPalette('extend', 'tl_user')
+    ->applyToPalette('custom', 'tl_user');
+
+
+$GLOBALS['TL_DCA']['tl_user']['fields']['leaflet_layers'] = [
+    'label'     => &$GLOBALS['TL_LANG']['tl_user']['leaflet_layers'],
+    'exclude'   => true,
+    'inputType' => 'treePicker',
+    'eval'      => [
+        'foreignTable'   => 'tl_leaflet_layer',
+        'titleField'     => 'title',
+        'searchField'    => 'title',
+        'managerHref'    => 'do=leaflet_layer',
+        'fieldType'      => 'checkbox',
+        'selectParents'  => true,
+        'multiple'       => true,
+        'pickerCallback' => ['netzmacht.contao_leaflet.listeners.dca.user', 'generateLayersRowLabel']
+    ],
+    'sql'       => 'blob NULL',
+];
+
+$GLOBALS['TL_DCA']['tl_user']['fields']['leaflet_tables'] = [
+    'label'     => &$GLOBALS['TL_LANG']['tl_user']['leaflet_tables'],
+    'exclude'   => true,
+    'inputType' => 'checkbox',
+    'options'   => ['tl_leaflet_style', 'tl_leaflet_icon', 'tl_leaflet_popup'],
+    'reference' => &$GLOBALS['TL_LANG']['MOD'],
+    'eval'      => [
+        'multiple' => true,
+    ],
+    'sql'       => 'mediumblob NULL',
+];
+
+$GLOBALS['TL_DCA']['tl_user']['fields']['leaflet_layer_permissions'] = [
+    'label'     => &$GLOBALS['TL_LANG']['tl_user']['leaflet_layer_permissions'],
+    'exclude'   => true,
+    'inputType' => 'checkbox',
+    'options'   => ['create', 'edit', 'delete', 'data'],
+    'reference' => &$GLOBALS['TL_LANG']['tl_user']['leaflet_layer_permissions_options'],
+    'eval'      => [
+        'helpwizard' => true,
+        'multiple' => true,
+    ],
+    'sql'       => 'mediumblob NULL',
+];

src/Bundle/Resources/contao/dca/tl_user_group.php

@@ -0,0 +1,67 @@
+<?php
+
+/**
+ * Leaflet maps for Contao CMS.
+ *
+ * @package    contao-leaflet-maps
+ * @author     David Molineus <david.molineus@netzmacht.de>
+ * @copyright  2014-2018 netzmacht David Molineus. All rights reserved.
+ * @license    LGPL-3.0 https://github.com/netzmacht/contao-leaflet-maps/blob/master/LICENSE
+ * @filesource
+ */
+
+declare(strict_types=1);
+
+use Contao\CoreBundle\DataContainer\PaletteManipulator;
+
+PaletteManipulator::create()
+    ->addLegend('leaflet_legend', 'amg_legend', PaletteManipulator::POSITION_BEFORE)
+    ->addField(
+        ['leaflet_layers', 'leaflet_layer_permissions', 'leaflet_tables'],
+        'leaflet_legend',
+        PaletteManipulator::POSITION_APPEND
+    )
+    ->applyToPalette('default', 'tl_user_group');
+
+
+$GLOBALS['TL_DCA']['tl_user_group']['fields']['leaflet_layers'] = [
+    'label'     => &$GLOBALS['TL_LANG']['tl_user_group']['leaflet_layers'],
+    'exclude'   => true,
+    'inputType' => 'treePicker',
+    'eval'      => [
+        'foreignTable'   => 'tl_leaflet_layer',
+        'titleField'     => 'title',
+        'searchField'    => 'title',
+        'managerHref'    => 'do=leaflet_layer',
+        'fieldType'      => 'checkbox',
+        'selectParents'  => true,
+        'multiple'       => true,
+        'pickerCallback' => ['netzmacht.contao_leaflet.listeners.dca.user_group', 'generateLayersRowLabel']
+    ],
+    'sql'       => 'blob NULL',
+];
+
+$GLOBALS['TL_DCA']['tl_user_group']['fields']['leaflet_tables'] = [
+    'label'     => &$GLOBALS['TL_LANG']['tl_user_group']['leaflet_tables'],
+    'exclude'   => true,
+    'inputType' => 'checkbox',
+    'options'   => ['tl_leaflet_style', 'tl_leaflet_icon', 'tl_leaflet_popup'],
+    'reference' => &$GLOBALS['TL_LANG']['MOD'],
+    'eval'      => [
+        'multiple' => true,
+    ],
+    'sql'       => 'mediumblob NULL',
+];
+
+$GLOBALS['TL_DCA']['tl_user_group']['fields']['leaflet_layer_permissions'] = [
+    'label'     => &$GLOBALS['TL_LANG']['tl_user_group']['leaflet_layer_permissions'],
+    'exclude'   => true,
+    'inputType' => 'checkbox',
+    'options'   => ['create', 'edit', 'delete', 'data'],
+    'reference' => &$GLOBALS['TL_LANG']['tl_user_group']['leaflet_layer_permissions_options'],
+    'eval'      => [
+        'helpwizard' => true,
+        'multiple' => true,
+    ],
+    'sql'       => 'mediumblob NULL',
+];

src/Bundle/Resources/contao/languages/en/modules.php

@@ -22,6 +22,8 @@ $GLOBALS['TL_LANG']['MOD']['leaflet_about'][1] = 'About the Leaflet integration
 $GLOBALS['TL_LANG']['MOD']['tl_leaflet_map']     = 'Maps';
 $GLOBALS['TL_LANG']['MOD']['tl_leaflet_layer']   = 'Layers';
 $GLOBALS['TL_LANG']['MOD']['tl_leaflet_icon']    = 'Icons';
+$GLOBALS['TL_LANG']['MOD']['tl_leaflet_style']   = 'Styles';
+$GLOBALS['TL_LANG']['MOD']['tl_leaflet_popup']   = 'Popup';
 $GLOBALS['TL_LANG']['MOD']['tl_leaflet_marker']  = 'Markers';
 $GLOBALS['TL_LANG']['MOD']['tl_leaflet_control'] = 'Controls';
 

src/Bundle/Resources/contao/languages/en/tl_user.php

@@ -0,0 +1,31 @@
+<?php
+
+/**
+ * Leaflet maps for Contao CMS.
+ *
+ * @package    contao-leaflet-maps
+ * @author     David Molineus <david.molineus@netzmacht.de>
+ * @copyright  2014-2018 netzmacht David Molineus. All rights reserved.
+ * @license    LGPL-3.0 https://github.com/netzmacht/contao-leaflet-maps/blob/master/LICENSE
+ * @filesource
+ */
+
+declare(strict_types=1);
+
+$GLOBALS['TL_LANG']['tl_user']['leaflet_legend'] = 'Leaflet Maps Permissions';
+
+$GLOBALS['TL_LANG']['tl_user']['leaflet_layers'][0]            = 'Allowed map layers';
+$GLOBALS['TL_LANG']['tl_user']['leaflet_layers'][1]            = 'Please choose the allowed map layers.';
+$GLOBALS['TL_LANG']['tl_user']['leaflet_layer_permissions'][0] = 'Layer permissions';
+$GLOBALS['TL_LANG']['tl_user']['leaflet_layer_permissions'][1] = 'Please choose which permissions are allowed for the map layer.';
+$GLOBALS['TL_LANG']['tl_user']['leaflet_tables'][0]            = 'Allows map tables';
+$GLOBALS['TL_LANG']['tl_user']['leaflet_tables'][1]            = 'Please choose which tables are allowed.';
+
+$GLOBALS['TL_LANG']['tl_user']['leaflet_layer_permissions_options']['create'][0] = 'Create layers';
+$GLOBALS['TL_LANG']['tl_user']['leaflet_layer_permissions_options']['create'][1] = 'Grant permission to create new layers.';
+$GLOBALS['TL_LANG']['tl_user']['leaflet_layer_permissions_options']['edit'][0]   = 'Edit layers';
+$GLOBALS['TL_LANG']['tl_user']['leaflet_layer_permissions_options']['edit'][1]   = 'Grant permission to edit layers.';
+$GLOBALS['TL_LANG']['tl_user']['leaflet_layer_permissions_options']['delete'][0] = 'Delete layers';
+$GLOBALS['TL_LANG']['tl_user']['leaflet_layer_permissions_options']['delete'][1] = 'Grant permission to delete layers.';
+$GLOBALS['TL_LANG']['tl_user']['leaflet_layer_permissions_options']['data'][0]   = 'Edit data';
+$GLOBALS['TL_LANG']['tl_user']['leaflet_layer_permissions_options']['data'][1]   = 'Grant permission to edit data of a layer.';

src/Bundle/Resources/contao/languages/en/tl_user_group.php

@@ -0,0 +1,31 @@
+<?php
+
+/**
+ * Leaflet maps for Contao CMS.
+ *
+ * @package    contao-leaflet-maps
+ * @author     David Molineus <david.molineus@netzmacht.de>
+ * @copyright  2014-2018 netzmacht David Molineus. All rights reserved.
+ * @license    LGPL-3.0 https://github.com/netzmacht/contao-leaflet-maps/blob/master/LICENSE
+ * @filesource
+ */
+
+declare(strict_types=1);
+
+$GLOBALS['TL_LANG']['tl_user_group']['leaflet_legend'] = 'Leaflet Maps Permissions';
+
+$GLOBALS['TL_LANG']['tl_user_group']['leaflet_layers'][0]            = 'Allowed map layers';
+$GLOBALS['TL_LANG']['tl_user_group']['leaflet_layers'][1]            = 'Please choose the allowed map layers.';
+$GLOBALS['TL_LANG']['tl_user_group']['leaflet_layer_permissions'][0] = 'Layer permissions';
+$GLOBALS['TL_LANG']['tl_user_group']['leaflet_layer_permissions'][1] = 'Please choose which permissions are allowed for the map layer.';
+$GLOBALS['TL_LANG']['tl_user_group']['leaflet_tables'][0]            = 'Allows map tables';
+$GLOBALS['TL_LANG']['tl_user_group']['leaflet_tables'][1]            = 'Please choose which tables are allowed.';
+
+$GLOBALS['TL_LANG']['tl_user_group']['leaflet_layer_permissions_options']['create'][0] = 'Create layers';
+$GLOBALS['TL_LANG']['tl_user_group']['leaflet_layer_permissions_options']['create'][1] = 'Grant permission to create new layers.';
+$GLOBALS['TL_LANG']['tl_user_group']['leaflet_layer_permissions_options']['edit'][0]   = 'Edit layers';
+$GLOBALS['TL_LANG']['tl_user_group']['leaflet_layer_permissions_options']['edit'][1]   = 'Grant permission to edit layers.';
+$GLOBALS['TL_LANG']['tl_user_group']['leaflet_layer_permissions_options']['delete'][0] = 'Delete layers';
+$GLOBALS['TL_LANG']['tl_user_group']['leaflet_layer_permissions_options']['delete'][1] = 'Grant permission to delete layers.';
+$GLOBALS['TL_LANG']['tl_user_group']['leaflet_layer_permissions_options']['data'][0]   = 'Edit data';
+$GLOBALS['TL_LANG']['tl_user_group']['leaflet_layer_permissions_options']['data'][1]   = 'Grant permission to edit data of a layer.';

src/Listener/Dca/AbstractUserDcaListener.php

@@ -0,0 +1,109 @@
+<?php
+
+/**
+ * Leaflet maps for Contao CMS.
+ *
+ * @package    contao-leaflet-maps
+ * @author     David Molineus <david.molineus@netzmacht.de>
+ * @copyright  2014-2018 netzmacht David Molineus. All rights reserved.
+ * @license    LGPL-3.0 https://github.com/netzmacht/contao-leaflet-maps/blob/master/LICENSE
+ * @filesource
+ */
+
+declare(strict_types=1);
+
+namespace Netzmacht\Contao\Leaflet\Listener\Dca;
+
+use Contao\Image;
+use Contao\StringUtil;
+use Netzmacht\Contao\Leaflet\Backend\Renderer\Label\Layer\LayerLabelRenderer;
+use Netzmacht\Contao\Leaflet\Model\LayerModel;
+use Netzmacht\Contao\Toolkit\Dca\Listener\AbstractListener;
+use Netzmacht\Contao\Toolkit\Dca\Manager;
+use Symfony\Component\Translation\TranslatorInterface as Translator;
+
+/**
+ * Class AbstractUserDcaListener
+ */
+abstract class AbstractUserDcaListener extends AbstractListener
+{
+    /**
+     * Layer label renderer.
+     *
+     * @var LayerLabelRenderer
+     */
+    private $labelRenderer;
+
+    /**
+     * Translator.
+     *
+     * @var Translator
+     */
+    private $translator;
+
+    /**
+     * Layers definitions.
+     *
+     * @var array
+     */
+    private $layers;
+
+    /**
+     * Constructor.
+     *
+     * @param Manager            $dcaManager    Dca manager.
+     * @param LayerLabelRenderer $labelRenderer Layer label renderer.
+     * @param Translator         $translator    Translator.
+     * @param array              $layers        Layers definition.
+     */
+    public function __construct(
+        Manager $dcaManager,
+        LayerLabelRenderer $labelRenderer,
+        Translator $translator,
+        array $layers
+    ) {
+        parent::__construct($dcaManager);
+
+        $this->labelRenderer = $labelRenderer;
+        $this->translator    = $translator;
+        $this->layers        = $layers;
+    }
+
+    /**
+     * Generate the layers row label.
+     *
+     * @param array $row Layer data row.
+     *
+     * @return string
+     */
+    public function generateLayersRowLabel(array $row): string
+    {
+        if (!empty($this->layers[$row['type']]['icon'])) {
+            $src = $this->layers[$row['type']]['icon'];
+        } else {
+            $src = 'iconPLAIN.gif';
+        }
+
+        $activeIcon   = $src;
+        $disabledIcon = preg_replace('/(\.[^\.]+)$/', '_1$1', $src);
+
+        if (!$row['active']) {
+            $src = $disabledIcon;
+        }
+
+        $alt        = $this->getFormatter(LayerModel::getTable())->formatValue('type', $row['type']);
+        $attributes = sprintf(
+            'class="list-icon" title="%s" data-icon="%s" data-icon-disabled="%s"',
+            StringUtil::specialchars(strip_tags($alt)),
+            $activeIcon,
+            $disabledIcon
+        );
+
+        $label  = $this->getFormatter(LayerModel::getTable())->formatValue('title', $row['title']);
+        $label .= sprintf(' <span class="tl_gray">[ID %s]</span>', $row['id']);
+        $icon   = Image::getHtml($src, $alt, $attributes);
+        $label  = $this->labelRenderer->render($row, $label, $this->translator);
+
+        return $icon . ' ' . $label;
+    }
+}

src/Listener/Dca/IconDcaListener.php

@@ -14,6 +14,10 @@ declare(strict_types=1);
 
 namespace Netzmacht\Contao\Leaflet\Listener\Dca;
 
+use Contao\BackendUser;
+use Contao\CoreBundle\Exception\AccessDeniedException;
+use Netzmacht\Contao\Leaflet\Model\IconModel;
+
 /**
  * Class IconDcaListener.
  *
@@ -21,6 +25,13 @@ namespace Netzmacht\Contao\Leaflet\Listener\Dca;
  */
 class IconDcaListener
 {
+    /**
+     * Contao backend user.
+     *
+     * @var BackendUser
+     */
+    private $user;
+
     /**
      * Icon type options.
      *
@@ -31,13 +42,33 @@ class IconDcaListener
     /**
      * IconDcaListener constructor.
      *
-     * @param array $icons Icon type options.
+     * @param BackendUser $user  Backend user.
+     * @param array       $icons Icon type options.
      */
-    public function __construct(array $icons)
+    public function __construct(BackendUser $user, array $icons)
     {
+        $this->user  = $user;
         $this->icons = $icons;
     }
 
+    /**
+     * Check the permission.
+     *
+     * @return void
+     *
+     * @throws AccessDeniedException If user has not the permission.
+     */
+    public function checkPermission(): void
+    {
+        if ($this->user->hasAccess(IconModel::getTable(), 'leaflet_tables')) {
+            return;
+        }
+
+        throw new AccessDeniedException(
+            sprintf('Access denied to "%s" for user "%s"', IconModel::getTable(), $this->user->id)
+        );
+    }
+
     /**
      * Get icon options.
      *

src/Listener/Dca/LayerDcaListener.php

@@ -13,9 +13,12 @@
 namespace Netzmacht\Contao\Leaflet\Listener\Dca;
 
 use Contao\Backend;
+use Contao\BackendUser;
+use Contao\CoreBundle\Exception\AccessDeniedException;
 use Contao\CoreBundle\Framework\Adapter;
 use Contao\DataContainer;
 use Contao\Image;
+use Contao\Input;
 use Contao\StringUtil;
 use Doctrine\DBAL\Connection;
 use Netzmacht\Contao\Leaflet\Backend\Renderer\Label\Layer\LayerLabelRenderer;
@@ -23,6 +26,7 @@ use Netzmacht\Contao\Leaflet\Model\IconModel;
 use Netzmacht\Contao\Leaflet\Model\LayerModel;
 use Netzmacht\Contao\Toolkit\Data\Model\RepositoryManager;
 use Netzmacht\Contao\Toolkit\Dca\Listener\AbstractListener;
+use Netzmacht\Contao\Toolkit\Dca\Listener\Button\StateButtonCallbackListener;
 use Netzmacht\Contao\Toolkit\Dca\Manager;
 use Netzmacht\Contao\Toolkit\Dca\Options\OptionsBuilder;
 use Symfony\Component\Translation\TranslatorInterface as Translator;
@@ -30,7 +34,7 @@ use Symfony\Component\Translation\TranslatorInterface as Translator;
 /**
  * Class Layer is the helper class for the tl_leaflet_layer dca.
  *
- * @package Netzmacht\Contao\Leaflet\Dca
+ * @SuppressWarnings(PHPMD.TooManyPublicMethods)
  */
 class LayerDcaListener extends AbstractListener
 {
@@ -76,6 +80,13 @@ class LayerDcaListener extends AbstractListener
      */
     private $translator;
 
+    /**
+     * Backend user.
+     *
+     * @var BackendUser
+     */
+    private $backendUser;
+
     /**
      * OSM amenities.
      *
@@ -104,19 +115,28 @@ class LayerDcaListener extends AbstractListener
      */
     private $backendAdapter;
 
+    /**
+     * State button callback listener.
+     *
+     * @var StateButtonCallbackListener
+     */
+    private $stateButtonCallbackListener;
+
     /**
      * Construct.
      *
-     * @param Manager            $manager           Data container manager.
-     * @param Connection         $connection        Database connection.
-     * @param RepositoryManager  $repositoryManager Repository manager.
-     * @param Translator         $translator        Translator.
-     * @param LayerLabelRenderer $labelRenderer     Layer label renderer.
-     * @param Adapter|Backend    $backendAdapter    Backend adapter.
-     * @param array              $layers            Leaflet layer configuration.
-     * @param array              $tileProviders     Tile providers.
-     * @param array              $amenities         OSM amenities.
-     * @param array              $fileFormats       File formats.
+     * @param Manager                     $manager                     Data container manager.
+     * @param Connection                  $connection                  Database connection.
+     * @param RepositoryManager           $repositoryManager           Repository manager.
+     * @param Translator                  $translator                  Translator.
+     * @param LayerLabelRenderer          $labelRenderer               Layer label renderer.
+     * @param BackendUser                 $backendUser                 Backend user.
+     * @param StateButtonCallbackListener $stateButtonCallbackListener State button callback listener.
+     * @param Adapter|Backend             $backendAdapter              Backend adapter.
+     * @param array                       $layers                      Leaflet layer configuration.
+     * @param array                       $tileProviders               Tile providers.
+     * @param array                       $amenities                   OSM amenities.
+     * @param array                       $fileFormats                 File formats.
      *
      * @SuppressWarnings(PHPMD.ExcessiveParameterList)
      */
@@ -126,6 +146,8 @@ class LayerDcaListener extends AbstractListener
         RepositoryManager $repositoryManager,
         Translator $translator,
         LayerLabelRenderer $labelRenderer,
+        BackendUser $backendUser,
+        StateButtonCallbackListener $stateButtonCallbackListener,
         $backendAdapter,
         array $layers,
         array $tileProviders,
@@ -134,15 +156,55 @@ class LayerDcaListener extends AbstractListener
     ) {
         parent::__construct($manager);
 
-        $this->connection        = $connection;
-        $this->layers            = $layers;
-        $this->tileProviders     = $tileProviders;
-        $this->translator        = $translator;
-        $this->amenities         = $amenities;
-        $this->labelRenderer     = $labelRenderer;
-        $this->fileFormats       = $fileFormats;
-        $this->repositoryManager = $repositoryManager;
-        $this->backendAdapter    = $backendAdapter;
+        $this->connection                  = $connection;
+        $this->layers                      = $layers;
+        $this->tileProviders               = $tileProviders;
+        $this->translator                  = $translator;
+        $this->amenities                   = $amenities;
+        $this->labelRenderer               = $labelRenderer;
+        $this->fileFormats                 = $fileFormats;
+        $this->repositoryManager           = $repositoryManager;
+        $this->backendAdapter              = $backendAdapter;
+        $this->backendUser                 = $backendUser;
+        $this->stateButtonCallbackListener = $stateButtonCallbackListener;
+    }
+
+    /**
+     * Check the permissions.
+     *
+     * @param DataContainer $dataContainer Data container.
+     *
+     * @return void
+     *
+     * @throws AccessDeniedException If permissions are not granted.
+     */
+    public function checkPermissions(DataContainer $dataContainer): void
+    {
+        if ($this->backendUser->isAdmin) {
+            return;
+        }
+
+        $action     = Input::get('act');
+        $permission = $this->determinePermission($action);
+
+        if ($permission && !$this->backendUser->hasAccess($permission, 'leaflet_layer_permissions')) {
+            throw new AccessDeniedException(
+                sprintf('Permission "%s" not granted to access layer "%s"', $permission, $dataContainer->id)
+            );
+        }
+
+        $this->getDefinition()->set(['list', 'sorting', 'root'], $this->backendUser->leaflet_layers);
+
+        $layerId = $this->determineLayerId();
+        if ($layerId && !$this->backendUser->hasAccess($layerId, 'leaflet_layers')) {
+            throw new AccessDeniedException(
+                sprintf('User "%s" not allowed to access layer "%s"', $this->backendUser->id, $layerId)
+            );
+        }
+
+        if (!$this->backendUser->hasAccess(LayerModel::PERMISSION_CREATE, 'leaflet_layer_permissions')) {
+            $this->getDefinition()->set(['config', 'closed'], true);
+        }
     }
 
     /**
@@ -306,6 +368,148 @@ class LayerDcaListener extends AbstractListener
         return $buffer;
     }
 
+    /**
+     * Generate the edit button.
+     *
+     * @param array  $row        Current row.
+     * @param string $href       The button href.
+     * @param string $label      The button label.
+     * @param string $title      The button title.
+     * @param string $icon       The button icon.
+     * @param string $attributes Optional attributes.
+     *
+     * @return string
+     */
+    public function generateEditButton($row, $href, $label, $title, $icon, $attributes): string
+    {
+        if ($this->backendUser->hasAccess('edit', 'leaflet_layer_permissions')) {
+            return $this->generateButton($row, $href, $label, $title, $icon, $attributes);
+        }
+
+        return '';
+    }
+
+    /**
+     * Generate the cut button.
+     *
+     * @param array  $row        Current row.
+     * @param string $href       The button href.
+     * @param string $label      The button label.
+     * @param string $title      The button title.
+     * @param string $icon       The button icon.
+     * @param string $attributes Optional attributes.
+     *
+     * @return string
+     */
+    public function generateCutButton($row, $href, $label, $title, $icon, $attributes): string
+    {
+        if ($this->backendUser->hasAccess('edit', 'leaflet_layer_permissions')) {
+            return $this->generateButton($row, $href, $label, $title, $icon, $attributes);
+        }
+
+        return '';
+    }
+
+    /**
+     * Generate the copy button.
+     *
+     * @param array  $row        Current row.
+     * @param string $href       The button href.
+     * @param string $label      The button label.
+     * @param string $title      The button title.
+     * @param string $icon       The button icon.
+     * @param string $attributes Optional attributes.
+     *
+     * @return string
+     */
+    public function generateCopyButton($row, $href, $label, $title, $icon, $attributes): string
+    {
+        if ($this->backendUser->hasAccess('create', 'leaflet_layer_permissions')) {
+            return $this->generateButton($row, $href, $label, $title, $icon, $attributes);
+        }
+
+        return '';
+    }
+
+    /**
+     * Generate the toggle button.
+     *
+     * @param array         $row               Current data row.
+     * @param string|null   $href              Button link.
+     * @param string|null   $label             Button label.
+     * @param string|null   $title             Button title.
+     * @param string|null   $icon              Enabled button icon.
+     * @param string|null   $attributes        Html attributes as string.
+     * @param string        $tableName         Table name.
+     * @param array|null    $rootIds           Root ids.
+     * @param array|null    $childRecordIds    Child record ids.
+     * @param bool          $circularReference Circular reference flag.
+     * @param string|null   $previous          Previous button name.
+     * @param string|null   $next              Next button name.
+     * @param DataContainer $dataContainer     Data container driver.
+     *
+     * @return string
+     *
+     * @SuppressWarnings(PHPMD.UnusedFormalParameter)
+     * @SuppressWarnings(PHPMD.ExcessiveParameterList)
+     */
+    public function generateToggleButton(
+        array $row,
+        $href,
+        $label,
+        $title,
+        $icon,
+        $attributes,
+        string $tableName,
+        $rootIds,
+        $childRecordIds,
+        bool $circularReference,
+        $previous,
+        $next,
+        $dataContainer
+    ): string {
+        if ($this->backendUser->hasAccess('edit', 'leaflet_layer_permissions')) {
+            return $this->stateButtonCallbackListener->handleButtonCallback(
+                $row,
+                $href,
+                $label,
+                $title,
+                $icon,
+                $attributes,
+                $tableName,
+                $rootIds,
+                $childRecordIds,
+                $circularReference,
+                $previous,
+                $next,
+                $dataContainer
+            );
+        }
+
+        return '';
+    }
+
+    /**
+     * Generate the edit button.
+     *
+     * @param array  $row        Current row.
+     * @param string $href       The button href.
+     * @param string $label      The button label.
+     * @param string $title      The button title.
+     * @param string $icon       The button icon.
+     * @param string $attributes Optional attributes.
+     *
+     * @return string
+     */
+    public function generateDeleteButton($row, $href, $label, $title, $icon, $attributes): string
+    {
+        if ($this->backendUser->hasAccess('delete', 'leaflet_layer_permissions')) {
+            return $this->generateButton($row, $href, $label, $title, $icon, $attributes);
+        }
+
+        return '';
+    }
+
     /**
      * Generate the markers button.
      *
@@ -324,6 +528,10 @@ class LayerDcaListener extends AbstractListener
             return '';
         }
 
+        if (!$this->backendUser->hasAccess('data', 'leaflet_layer_permissions')) {
+            return '';
+        }
+
         return $this->generateButton($row, $href, $label, $title, $icon, $attributes);
     }
 
@@ -345,6 +553,10 @@ class LayerDcaListener extends AbstractListener
             return '';
         }
 
+        if (!$this->backendUser->hasAccess('data', 'leaflet_layer_permissions')) {
+            return '';
+        }
+
         return $this->generateButton($row, $href, $label, $title, $icon, $attributes);
     }
 
@@ -522,4 +734,82 @@ class LayerDcaListener extends AbstractListener
             Image::getHtml($icon, $label, $attributes)
         );
     }
+
+    /**
+     * Determine permission for current action.
+     *
+     * @param string|null $action Given action.
+     *
+     * @return string|null
+     *
+     * @SuppressWarnings(PHPMD.CyclomaticComplexity)
+     */
+    private function determinePermission(?string $action): ?string
+    {
+        $permission = null;
+
+        switch ($action) {
+            case 'edit':
+            case 'toggle':
+            case 'editAll':
+            case 'overrideAll':
+            case 'cutAll':
+                return LayerModel::PERMISSION_EDIT;
+
+            case 'delete':
+            case 'deleteAll':
+                return LayerModel::PERMISSION_DELETE;
+
+            case 'copyAll':
+                return LayerModel::PERMISSION_CREATE;
+
+            case 'paste':
+                $mode = Input::get('mode');
+
+                switch ($mode) {
+                    case 'create':
+                        return LayerModel::PERMISSION_CREATE;
+
+                    case 'cut':
+                        return LayerModel::PERMISSION_EDIT;
+
+                    default:
+                        return $permission;
+                }
+
+                // Comment just to please phpcs
+            default:
+                return $permission;
+        }
+    }
+
+
+    /**
+     * Determine the layer id.
+     *
+     * @return int|null
+     *
+     * @SuppressWarnings(PHPMD.CyclomaticComplexity)
+     */
+    private function determineLayerId(): ?int
+    {
+        // Check the current action
+        switch (Input::get('act')) {
+            case 'edit':
+            case 'delete':
+            case 'paste':
+            case 'show':
+                return (int) Input::get('id');
+
+            case 'editAll':
+            case 'deleteAll':
+            case 'overrideAll':
+            case 'cutAll':
+            case 'copyAll':
+                return (int) CURRENT_ID;
+
+            default:
+                return null;
+        }
+    }
 }

src/Listener/Dca/MarkerDcaListener.php

@@ -12,10 +12,13 @@
 
 namespace Netzmacht\Contao\Leaflet\Listener\Dca;
 
-use Contao\Controller;
+use Contao\BackendUser;
+use Contao\CoreBundle\Exception\AccessDeniedException;
+use Contao\Input;
 use Contao\StringUtil;
 use Doctrine\DBAL\Connection;
 use Netzmacht\Contao\Leaflet\Model\IconModel;
+use Netzmacht\Contao\Leaflet\Model\LayerModel;
 use Netzmacht\Contao\Leaflet\Model\PopupModel;
 use Netzmacht\Contao\Toolkit\Data\Model\RepositoryManager;
 use Netzmacht\Contao\Toolkit\Dca\Options\OptionsBuilder;
@@ -41,16 +44,48 @@ class MarkerDcaListener
      */
     private $repositoryManager;
 
+    /**
+     * Backend user.
+     *
+     * @var BackendUser
+     */
+    private $backendUser;
+
     /**
      * MarkerDcaListener constructor.
      *
      * @param Connection        $connection        Database connection.
      * @param RepositoryManager $repositoryManager Repository manager.
+     * @param BackendUser       $backendUser       Backend user.
      */
-    public function __construct(Connection $connection, RepositoryManager $repositoryManager)
+    public function __construct(Connection $connection, RepositoryManager $repositoryManager, BackendUser $backendUser)
     {
         $this->connection        = $connection;
         $this->repositoryManager = $repositoryManager;
+        $this->backendUser       = $backendUser;
+    }
+
+    /**
+     * Check permissions.
+     *
+     * @return void
+     *
+     * @throws AccessDeniedException When permission is not granted.
+     */
+    public function checkPermissions(): void
+    {
+        if (!$this->backendUser->hasAccess(LayerModel::PERMISSION_DATA, 'leaflet_layer_permissions')) {
+            throw new AccessDeniedException(
+                sprintf('User "%s" not allowed to access layer data.', $this->backendUser->id)
+            );
+        }
+
+        $layerId = $this->determineLayerId();
+        if ($layerId && !$this->backendUser->hasAccess($layerId, 'leaflet_layers')) {
+            throw new AccessDeniedException(
+                sprintf('User "%s" not allowed to access layer "%s"', $this->backendUser->id, $layerId)
+            );
+        }
     }
 
     /**
@@ -165,4 +200,25 @@ class MarkerDcaListener
 
         return '';
     }
+
+    /**
+     * Determine the layer id.
+     *
+     * @return int|null
+     *
+     * @SuppressWarnings(PHPMD.CyclomaticComplexity)
+     */
+    private function determineLayerId(): ?int
+    {
+        // Check the current action
+        switch (Input::get('act')) {
+            case '':
+            case 'create':
+            case 'select':
+                return (int) Input::get('id');
+
+            default:
+                return (int) CURRENT_ID;
+        }
+    }
 }

src/Listener/Dca/OperationsListener.php

@@ -0,0 +1,169 @@
+<?php
+
+/**
+ * Leaflet maps for Contao CMS.
+ *
+ * @package    contao-leaflet-maps
+ * @author     David Molineus <david.molineus@netzmacht.de>
+ * @copyright  2014-2018 netzmacht David Molineus. All rights reserved.
+ * @license    LGPL-3.0 https://github.com/netzmacht/contao-leaflet-maps/blob/master/LICENSE
+ * @filesource
+ */
+
+declare(strict_types=1);
+
+namespace Netzmacht\Contao\Leaflet\Listener\Dca;
+
+use Contao\Backend;
+use Contao\BackendUser;
+use Netzmacht\Contao\Leaflet\Model\IconModel;
+use Netzmacht\Contao\Leaflet\Model\PopupModel;
+use Netzmacht\Contao\Leaflet\Model\StyleModel;
+
+/**
+ * Class OperationsListener
+ */
+final class OperationsListener
+{
+    /**
+     * Backend user.
+     *
+     * @var BackendUser
+     */
+    private $user;
+
+    /**
+     * OperationsListener constructor.
+     *
+     * @param BackendUser $user Backend user.
+     */
+    public function __construct(BackendUser $user)
+    {
+        $this->user = $user;
+    }
+
+    /**
+     * Generate the style operation.
+     *
+     * @param string $href       Button link.
+     * @param string $label      Button label.
+     * @param string $title      Button title.
+     * @param string $class      Button icon class.
+     * @param string $attributes Html attributes.
+     *
+     * @return string
+     */
+    public function styleOperation(
+        string $href,
+        string $label,
+        string $title,
+        string $class,
+        string $attributes
+    ): string {
+        return $this->renderIfPermissionIsGranted(StyleModel::getTable(), $href, $label, $title, $class, $attributes);
+    }
+
+    /**
+     * Generate the icon operation.
+     *
+     * @param string $href       Button link.
+     * @param string $label      Button label.
+     * @param string $title      Button title.
+     * @param string $class      Button icon class.
+     * @param string $attributes Html attributes.
+     *
+     * @return string
+     */
+    public function iconOperation(
+        string $href,
+        string $label,
+        string $title,
+        string $class,
+        string $attributes
+    ): string {
+        return $this->renderIfPermissionIsGranted(IconModel::getTable(), $href, $label, $title, $class, $attributes);
+    }
+
+    /**
+     * Generate the popup operation.
+     *
+     * @param string $href       Button link.
+     * @param string $label      Button label.
+     * @param string $title      Button title.
+     * @param string $class      Button icon class.
+     * @param string $attributes Html attributes.
+     *
+     * @return string
+     */
+    public function popupOperation(
+        string $href,
+        string $label,
+        string $title,
+        string $class,
+        string $attributes
+    ): string {
+        return $this->renderIfPermissionIsGranted(PopupModel::getTable(), $href, $label, $title, $class, $attributes);
+    }
+
+    /**
+     * Check if user has permission to access the leaflet table.
+     *
+     * @param string $permission The table permission.
+     *
+     * @return bool
+     */
+    private function hasPermission(string $permission): bool
+    {
+        return (bool) $this->user->hasAccess($permission, 'leaflet_tables');
+    }
+
+    /**
+     * Generate the style operation.
+     *
+     * @param string $permission Table permission to check.
+     * @param string $href       Button link.
+     * @param string $label      Button label.
+     * @param string $title      Button title.
+     * @param string $class      Button icon class.
+     * @param string $attributes Html attributes.
+     *
+     * @return string
+     */
+    private function renderIfPermissionIsGranted(
+        string $permission,
+        string $href,
+        string $label,
+        string $title,
+        string $class,
+        string $attributes
+    ): string {
+        if ($this->hasPermission($permission)) {
+            return $this->render($href, $label, $title, $class, $attributes);
+        }
+
+        return '';
+    }
+
+    /**
+     * Render a button.
+     *
+     * @param string $href       Button link.
+     * @param string $label      Button label.
+     * @param string $title      Button title.
+     * @param string $class      Button icon class.
+     * @param string $attributes Html attributes.
+     *
+     * @return string
+     */
+    private function render(string $href, string $label, string $title, string $class, string $attributes): string
+    {
+        return sprintf(
+            ' <a href="%s" title="%s" class="%s" %s>%s</a>',
+            Backend::addToUrl($href),
+            $title,
+            $class,
+            $attributes,
+            $label
+        );
+    }
+}

src/Listener/Dca/PopupDcaListener.php

@@ -0,0 +1,60 @@
+<?php
+
+/**
+ * Leaflet maps for Contao CMS.
+ *
+ * @package    contao-leaflet-maps
+ * @author     David Molineus <david.molineus@netzmacht.de>
+ * @copyright  2014-2018 netzmacht David Molineus. All rights reserved.
+ * @license    LGPL-3.0 https://github.com/netzmacht/contao-leaflet-maps/blob/master/LICENSE
+ * @filesource
+ */
+
+declare(strict_types=1);
+
+namespace Netzmacht\Contao\Leaflet\Listener\Dca;
+
+use Contao\BackendUser;
+use Contao\CoreBundle\Exception\AccessDeniedException;
+use Netzmacht\Contao\Leaflet\Model\PopupModel;
+
+/**
+ * Class PopupDcaListener
+ */
+final class PopupDcaListener
+{
+    /**
+     * Backend user.
+     *
+     * @var BackendUser
+     */
+    private $user;
+
+    /**
+     * PopupDcaListener constructor.
+     *
+     * @param BackendUser $user Backend user.
+     */
+    public function __construct(BackendUser $user)
+    {
+        $this->user = $user;
+    }
+
+    /**
+     * Check the permission.
+     *
+     * @return void
+     *
+     * @throws AccessDeniedException If user has not the permission.
+     */
+    public function checkPermission(): void
+    {
+        if ($this->user->hasAccess(PopupModel::getTable(), 'leaflet_tables')) {
+            return;
+        }
+
+        throw new AccessDeniedException(
+            sprintf('Access denied to "%s" for user "%s"', PopupModel::getTable(), $this->user->id)
+        );
+    }
+}

src/Listener/Dca/StyleDcaListener.php

@@ -14,6 +14,10 @@ declare(strict_types=1);
 
 namespace Netzmacht\Contao\Leaflet\Listener\Dca;
 
+use Contao\BackendUser;
+use Contao\CoreBundle\Exception\AccessDeniedException;
+use Netzmacht\Contao\Leaflet\Model\StyleModel;
+
 /**
  * Class StyleDcaListener.
  *
@@ -21,6 +25,13 @@ namespace Netzmacht\Contao\Leaflet\Listener\Dca;
  */
 class StyleDcaListener
 {
+    /**
+     * Backend user.
+     *
+     * @var BackendUser
+     */
+    private $user;
+
     /**
      * Style type options.
      *
@@ -31,11 +42,31 @@ class StyleDcaListener
     /**
      * StyleDcaListener constructor.
      *
-     * @param array $styles Styles options.
+     * @param BackendUser $user   Backend user.
+     * @param array       $styles Styles options.
      */
-    public function __construct(array $styles)
+    public function __construct(BackendUser $user, array $styles)
     {
         $this->icons = $styles;
+        $this->user  = $user;
+    }
+
+    /**
+     * Check the permission.
+     *
+     * @return void
+     *
+     * @throws AccessDeniedException If user has not the permission.
+     */
+    public function checkPermission(): void
+    {
+        if ($this->user->hasAccess(StyleModel::getTable(), 'leaflet_tables')) {
+            return;
+        }
+
+        throw new AccessDeniedException(
+            sprintf('Access denied to "%s" for user "%s"', StyleModel::getTable(), $this->user->id)
+        );
     }
 
     /**

src/Listener/Dca/UserDcaListener.php

@@ -0,0 +1,28 @@
+<?php
+
+/**
+ * Leaflet maps for Contao CMS.
+ *
+ * @package    contao-leaflet-maps
+ * @author     David Molineus <david.molineus@netzmacht.de>
+ * @copyright  2014-2018 netzmacht David Molineus. All rights reserved.
+ * @license    LGPL-3.0 https://github.com/netzmacht/contao-leaflet-maps/blob/master/LICENSE
+ * @filesource
+ */
+
+declare(strict_types=1);
+
+namespace Netzmacht\Contao\Leaflet\Listener\Dca;
+
+/**
+ * Class UserDcaListener
+ */
+final class UserDcaListener extends AbstractUserDcaListener
+{
+    /**
+     * Data container name.
+     *
+     * @var string
+     */
+    protected static $name = 'tl_user';
+}

src/Listener/Dca/UserGroupDcaListener.php

@@ -0,0 +1,28 @@
+<?php
+
+/**
+ * Leaflet maps for Contao CMS.
+ *
+ * @package    contao-leaflet-maps
+ * @author     David Molineus <david.molineus@netzmacht.de>
+ * @copyright  2014-2018 netzmacht David Molineus. All rights reserved.
+ * @license    LGPL-3.0 https://github.com/netzmacht/contao-leaflet-maps/blob/master/LICENSE
+ * @filesource
+ */
+
+declare(strict_types=1);
+
+namespace Netzmacht\Contao\Leaflet\Listener\Dca;
+
+/**
+ * Class UserGroupDcaListener
+ */
+final class UserGroupDcaListener extends AbstractUserDcaListener
+{
+    /**
+     * Data container name.
+     *
+     * @var string
+     */
+    protected static $name = 'tl_user_group';
+}

src/Listener/Dca/VectorDcaListener.php

@@ -12,6 +12,10 @@
 
 namespace Netzmacht\Contao\Leaflet\Listener\Dca;
 
+use Contao\BackendUser;
+use Contao\CoreBundle\Exception\AccessDeniedException;
+use Contao\Input;
+use Netzmacht\Contao\Leaflet\Model\LayerModel;
 use Netzmacht\Contao\Leaflet\Model\PopupModel;
 use Netzmacht\Contao\Leaflet\Model\StyleModel;
 use Netzmacht\Contao\Toolkit\Data\Model\RepositoryManager;
@@ -47,19 +51,55 @@ class VectorDcaListener extends AbstractListener
      */
     private $repositoryManager;
 
+    /**
+     * Backend user.
+     *
+     * @var BackendUser
+     */
+    private $backendUser;
+
     /**
      * Construct.
      *
      * @param Manager           $dcaManager        Data container manager.
      * @param RepositoryManager $repositoryManager Repository manager.
+     * @param BackendUser       $backendUser       Backend user.
      * @param array             $vectors           Vectors.
      */
-    public function __construct(Manager $dcaManager, RepositoryManager $repositoryManager, array $vectors)
-    {
+    public function __construct(
+        Manager $dcaManager,
+        RepositoryManager $repositoryManager,
+        BackendUser $backendUser,
+        array $vectors
+    ) {
         parent::__construct($dcaManager);
 
         $this->vectors           = $vectors;
         $this->repositoryManager = $repositoryManager;
+        $this->backendUser       = $backendUser;
+    }
+
+    /**
+     * Check permissions.
+     *
+     * @return void
+     *
+     * @throws AccessDeniedException When permission is not granted.
+     */
+    public function checkPermissions(): void
+    {
+        if (!$this->backendUser->hasAccess(LayerModel::PERMISSION_DATA, 'leaflet_layer_permissions')) {
+            throw new AccessDeniedException(
+                sprintf('User "%s" not allowed to access layer data.', $this->backendUser->id)
+            );
+        }
+
+        $layerId = $this->determineLayerId();
+        if ($layerId && !$this->backendUser->hasAccess($layerId, 'leaflet_layers')) {
+            throw new AccessDeniedException(
+                sprintf('User "%s" not allowed to access layer "%s"', $this->backendUser->id, $layerId)
+            );
+        }
     }
 
     /**
@@ -114,4 +154,25 @@ class VectorDcaListener extends AbstractListener
 
         return $builder->getOptions();
     }
+
+    /**
+     * Determine the layer id.
+     *
+     * @return int|null
+     *
+     * @SuppressWarnings(PHPMD.CyclomaticComplexity)
+     */
+    private function determineLayerId(): ?int
+    {
+        // Check the current action
+        switch (Input::get('act')) {
+            case '':
+            case 'create':
+            case 'select':
+                return (int) Input::get('id');
+
+            default:
+                return (int) CURRENT_ID;
+        }
+    }
 }

src/Model/LayerModel.php

@@ -27,6 +27,14 @@ use Contao\Model\Collection;
  */
 class LayerModel extends AbstractActiveModel
 {
+    public const PERMISSION_EDIT = 'edit';
+
+    public const PERMISSION_CREATE = 'create';
+
+    public const PERMISSION_DELETE = 'delete';
+
+    public const PERMISSION_DATA = 'data';
+
     /**
      * Model table.
      *