Lock down certain member groups in the CP so other members can’t delete them?

Question

Does anyone know if there is there a way to lock down certain member groups in the CP so other members can’t delete member accounts belonging to those member groups?

I have a specific member group, let's call them 'Administrators' which need to be able to create members and delete members in another member group, called 'Customers'. But I don't want the 'Administrators' to be able to delete members in other member groups.

Does that make sense. Any ideas?

Answer 1

As Alex mentions, when a user has "Can delete members" rights, he/she can delete any member.

A different approach would be to, not allow to delete members, but to only allow users to be moved to a member group with no (login) rights at all. You can restrict to which group a member can be assigned by setting the group to "locked". If needed, the restricted member group could regularly be purged by a super-admin.

Answer 2

I think GDmac's answer is the way to go. But I thought it would be fun to start on an extension....

This seems to do the trick, though it is pretty bare-bones (no settings, not much detail in the message shown to the user).

Using the member_delete hook:

public function member_delete($member_ids)
{

    // Array of member group_ids for which to restrict delete permissions
    $supervised_member_groups = array('7');

    // Array of member group_ids for wich deletion is disallowed
    $protected_member_groups = array('5','6');

    // The group_id of the current admin
    $current_admin_group_id = ee()->session->userdata('group_id');

    // Check if the current admin is in the supervised member group
    if (in_array($current_admin_group_id, $supervised_member_groups))
    {
        // Generate an array of group_ids to which the deleted member(s) belong(s)
        $member_groups = array();
        $query = ee()->db->select('group_id')->where_in('member_id', $member_ids)->get('members');
        foreach ($query->result() as $row) 
        {
            array_push($member_groups, $row->group_id);
        }

        // Check if the deleted member belongs to one of the protected member groups 
        // and if so throw an error
        $overlap = count(array_intersect($protected_member_groups, $member_groups));            
        if ($overlap) show_error('You are attempting to delete a member from a protected group. Please adjust your selection.');
    }

    return $member_ids;
}

Gist with full extension