search

CCP-NC / ccpnc-database

4 stars 3 forks source link

Debug: Handle exception when user not logged in, Hide Record button is hidden to non-admin #38

Closed Sathya-S3 closed 4 months ago

Sathya-S3 commented 4 months ago

Expectation: The is_admin() and get_details() functions within the LoginStatus service object are utilised to check the login details for the current active browser session. If the ORCID ID of the logged in user does not match one from adminlist.yaml (this check is performed by is_admin() function in orcid.py), the expected outcome is that the 'Hide record' button for each record should be hidden.

Detected bug: Checking if "details['admin'] == true" was vital to decide if the 'Hide record' button should be displayed or not. The is_admin() function seemed to return a 'null' value when a user was not logged in. Therefore, trying to access details['admin'] to evaluate threw a JavaScript error and the 'Hide record' button display check was skipped in database_record.html, causing the button to be permanently displayed.

Fix: The 'null' return condition within is_admin() is better handled, returning a valid Boolean value of 'False' so that the 'Hide record' button is hidden when no user is logged in.

Condition for correct working satisfied:

  1. Performed a search without logging in, 'Hide record' button not visible.
  2. Performed a search when logging in with Sandbox ORCID account, 'Hide record' button not visible.
  3. Performed a search when logging in with Main ORCID account (ID included in adminlist.yaml), 'Hide record' button visible.