search

18F / micropurchase

18F's micro-purchase threshold experiment management app.
https://micropurchase.18f.gov
Other
68 stars 34 forks source link

Admins cannot bid on auctions #995

Closed jessieay closed 8 years ago

jessieay commented 8 years ago

As an admin, I want to be prevented from accidentally bidding on an auction, so that I don't make that mistake. So the bid box should not even appear to me when I view open auctions

right now, when I visit an open auction I both see a message meant for admins and the bid box. This is because I am technically able to bid as a user with a valid duns number.

we should add logic that ensures admins do not see a bid box. This might also mean we will need better ways to see what things look like as a non-admin because it is not currently possible to toggle back and forth out side of development

Three features here:

  1. Admins cannot bid on auctions

See #1084 for toggle functionality

Suggestion: Still show the bid box but have a single line in auctions.rb to prevent the bid from being saved.

Let's groom next week and come up with a story/stories to address this.

harrisj commented 8 years ago

This makes sense, but we need to be able to bid on test auctions on staging. The problem is that I think our staging servers think they are running in the Rails production environment, so we can't just simply check Rails.env.staging?. It seems like we could perhaps define another env variable like MPT_ADMIN_CAN_BID on the staging app though if we wanted to support that

harrisj commented 8 years ago

Another approach would be to just have multiple logins for each of us on staging (admin vs. vendor), although that becomes a bit of a pain using Github Oauth

jessieay commented 8 years ago

Agree that we need a way to bid on staging -- already, we are creating features for the main part of the app that are admin-specific, and I'd love to be able to view the app as a whole as someone who is not an admin.

Here's a blog post on adding the ability to log in as other users: http://www.brownwebdesign.com/blog/logon-as-another-user-in-a-rails-app

we could create a few dummy users on staging and prod for the purpose of viewing the app

mtorres253 commented 8 years ago

@harrisj @jessieay is this a feature?

jessieay commented 8 years ago

it is in the sense that if we are not going to allow admins to bid, we need to provide a way for admins to see the app as a regular vendor.

the confusing thing about allowing admins to bid is that I am seeing both vendor messaging and admin messsaging now that we had special content for admins outside of the admin section of the app

further, I do think it makes sense to prevent admins from bidding (at least on prod) since as a policy we don't want admins bidding, right?

andrewmaier commented 8 years ago

I agree with @jessieay: Admins shouldn't be able to bid. And this issue suggests that the current design/implementation doesn't properly account for the difference between "admins" and "vendors."

The product-development team is going to need a way of logging in as an admin and logging in as a vendor in order to properly acceptance test Micro-purchase. One way to do this is to have a "dummy vendor" login on testing and staging. Another (more involved) way to do this is to provide a quick "toggle," similar to the prototype-header I've created, that allows you to see "who sees what" by changing a select-box.

That said: user-swapping isn't a Micro-purchase/product feature. Being able to look at the world from the point-of-view of various users is something that product managers, UX designers, and developers will need to be able to do in order to do their own acceptance testing. It cannot be rationalized in the form of a user story.

mtorres253 commented 8 years ago

Let's discuss in planning. We want to prevent admins from bidding, but is this really necessary right now? If so, let's come up with some acceptance criteria for a MMF and align.

jessieay commented 8 years ago

https://robots.thoughtbot.com/how-to-masquerade-as-another-user-to-see-how-they-use-yo https://coderwall.com/p/e7iyxw/devise-fast-user-switching-using-a-custom-authentication-strategy http://www.justinweiss.com/articles/how-rails-sessions-work/

jessieay commented 8 years ago

https://github.com/flyerhzm/switch_user

mtorres253 commented 8 years ago

Some questions for today:

jessieay commented 8 years ago

I think we can let whoever implements this decide on the implementation details, hard to know without spending real time working on it.