DiSSCo / ELViS

European Loans and Visits System
https://elvis.dissco.eu/
6 stars 2 forks source link

Hide Main Menu item "Requesters" for anyone except Admins and TAF Admins #231

Closed cannedit closed 2 years ago

cannedit commented 2 years ago

Description

NHM Evaluation Excel sheet no. 1: All requesters can see name, e-mail, gender & ORCID ID of all ELViS-registered users. Requesters' personal information should be visible only to the requester themselves and to TAF administrators / Risk of information mis-use.

Agreement

We will solve this 'Quick and Dirty': make the Main Menu item "Requesters" only visible for Admins & TAF Admins

LarissaS commented 2 years ago

as a regular user I do not see Requesters, only Requests. But in Request I can see a name, email and orcid id of a requester.

cannedit commented 2 years ago

That's correct, but this is a Quick and Dirty method to solve the main problem: anyone having access to all profile info of al requesters. In case you can see a request, you are probably involved in that request one way or another (at least for TA Call requests), so then it's hard to hide names/email addresses/orcid id's of other requesters involved.

emhaston commented 2 years ago

First, I need to check I'm testing the correct test version! :). I can't see Requesters tab in either my admin or my regular account. I can see 72 requests in both my regular and my admin accounts.

philippeloret commented 2 years ago

It's ok, I cannot see the main menu item "Requesters" (only Requests).

B-San-Chi commented 2 years ago

Ok also for me, I only see Requests in both cases

cannedit commented 2 years ago

@emhaston: you should be able to see the main menu item "Requesters" when logged in with an admin account, but not with your regular (requester role only?) account; can you please verify this?

wouteraddink commented 2 years ago

for user without extra roles (requester), the roles overview in the profile looks a bit weird: Institution based - Roles - Country based - Roles -

Is this what I am supposed to see? I find this overview confusing for the requester.

wouteraddink commented 2 years ago

Under the institutions/people tab, you can as requester still see the email addresses from all people.

cannedit commented 2 years ago

@wouteraddink: I think the info about employees of institutions can be useful in case someone wants to contact somebody from an institution. As for the (empty) summing up of roles for common users (without extra roles) looking weird: this is an indication that it is possible to have roles, so I think we should change this functionality, but rather explain it in the user manual.

cannedit commented 2 years ago

See Github issue #240 and in addition: the labels "Institution based" and "Country based" are now changed.

mmarschler commented 2 years ago

For me the wording is ok.

LarissaS commented 2 years ago

The wording is ok now. But I agree with Wouter that every requester can see now email addresses of people affiliated to the institution. If people have a role like TA, VA coordinators, then it's ok, But for other people affiliated to the institution but without possibility to specify their position at the institution, like curator of certain collection of head of a department, for example, then it has no sense that requestors see these email addresses. And if people use private email address it will be visible too.

wolodkin commented 2 years ago

As a new user I wasn't sure what's meant at first :

Roles for Institution - Roles - Roles for Country - Roles -

I would prefer to use a phrase like "You are a ROLE at..." if there ist a role.

cannedit commented 2 years ago

@LarissaS @wolodkin: I understand your comments, but we decided in the WP6 meeting upon the wording as well as only hide the role of TA Scorer in the tab "People" per Institution.