How Durable Approval Requests Protect Group Changes and Deletion

Frontend User Manager group changes and deletions are more sensitive than ordinary onboarding, so QCFUM stores them as durable approval-request records when those approval switches are enabled.

The saved request describes what was asked for. It is not a permanent authorization snapshot: QCFUM re-checks the current site state before an approved action is actually applied.

What QCFUM Stores

QCFUM writes User Manager requests to #__qcfum_action_approvals with request type, submitting actor, target user, serialized request payload, status, timestamps, and later reviewer information. Supported request types are group_change and delete_user.

One Pending Request per Action Type and Target

If the same target already has a pending request of the same type, QCFUM updates that pending row with the latest actor/payload instead of creating unlimited duplicate pending requests. Group-change payloads carry the requested direct group selection; delete requests carry the configured delete behavior.

Approval Revalidates Current Safety Rules

Before execution, QCFUM requires approval permission and current Frontend User Manager entitlement. It reloads the target and refuses protected/unavailable users. Delete requests additionally re-check that deletion is still enabled and the target remains editable. Group changes pass through the current group-change validator and protection rules.

One-Time Decision Semantics

For an approval, QCFUM atomically claims a pending request by changing it to processing before applying the action. This prevents two reviewers from applying the same destructive/change request concurrently. A successful action finishes as approved; rejection moves a pending request to rejected.

What Happens If Application Fails

If a claimed approval cannot be applied, QCFUM returns the request to pending, clears the reviewer claim, and stores the most recent apply error and timestamp in metadata. That allows the underlying configuration or target problem to be corrected without silently losing the request.

Community Discussion

Want to compare Joomla user-onboarding workflows, share practical QCFUM tips, or discuss how other administrators use this feature? Visit the QC Frontend User Manager Community. For private support, bug reports, account-specific entitlement problems, or feature requests, use the QuantaCade support system.