So you want to create a many-to-many relationship between users and groups and only users that are already members of a given group can add a new user to this group right ?
If so here is how I would do it...
Group creation
// Create the group and add its creator as the sole group member
PFUser * user = [PFUser currentUser];
PFObject * group = [[PFObject alloc] initWithClassName:@"Group"];
PFRelation * members = [group relationForKey:@"members"];
[members addObject:user];
// Set an ACL so that the group is visible but only the
PFACL * acl = [PFACL ACL];
[acl setPublicReadAccess:true];
[acl setWriteAccess:true forUser: user];
group.ACL = cal
Add a new group member
PFUser * member = [PFUser currentUser];
PFUser * candidate = ...; // not yet a member
PFObject * group = ...; // The group candidate wants to join
PFRelation * members = [group relationForKey:@"members"];
[members addObject:candidate];
[group.ACL setWriteAccess:true forUser:candidate];
In step 2, member is a member of group and so has write access required to add a new user, candidate.
After step 2, candidate is now a full member and has gained write access to the group.
However I have not tested this:
- Does the relation "inherits" the ACL from the group ? Or anyone that can read the group, can access the relation and then add itself to the group ?
Also it seems hard to distinguish roles among members. I think that now any member could decide to delete the group...
You're probably better off enforcing the rules at application level.