search

CivicTechFredericton / mealplanner

Primary Meal Planner repo
MIT License
9 stars 18 forks source link

[BUG] Duplicate meal plan for a client user should have the current user assigned as they cannot assign themselves #698

Closed shanthisa closed 5 months ago

shanthisa commented 6 months ago

Describe the bug Since we removed the functionality to assign user, when we create a duplicate meal plan the new meal plan will not have any user assigned.

To Reproduce Steps to reproduce the behavior:

  1. Go to 'mealplan page' as a client (app_user role)
  2. Click on 'copy' button in a mealplan
  3. Observe the user of the newly created duplicate meal plan

Expected behavior The user should be the current logged in user as the client will want to have their id to be associated with their meal plan.

Additional context Solution: So when it is app_user role who has logged in, duplicate_meal_plan should take the current person id as p_id.

shanthisa commented 6 months ago

The reason I said that this needs to be done as a migration is because it is a security issue when we have the check only in the frontend. Through JavaScript console one can set a different user for a meal plan. So it is not the best practices. However for now I shall accept this PR. But this needs to be re-implemented with a check whether it is the current user when it is of the role app_user to ensure we don’t all app_user to assign any other user for the mealplan. I am approving and merging because it will not be seen by the client and it is required for the demo.

olamakhlouf commented 5 months ago

QA is done. test case MP-DuplicateMealPlanForClient-098 : Passed.

jon-dalton commented 5 months ago

Ok to close! 👍