search

FrancisG-Massey / Capstone2016

4 stars 0 forks source link

Restrict visibility of inactive entities to admins only #186

Closed sam-hunt closed 8 years ago

sam-hunt commented 8 years ago

This applies to GET and PUT only. All new entities created via POST begin as active. Inactive (deleted) entities cannot be DELETEd again.

Its probably a good idea to show inactive traplines and traps to the trapline admins.

Partially dependent on #161.

sam-hunt commented 8 years ago

Okay, after discussion:

  1. The inactive flag will not be updatable via PUT requests as this adds unnecessary complexity and allows users to circumvent the permissions on DELETE. In extremely rare case that a user needs a deleted entity to be reactivated, they should contact their IT manager or database administrator.
  2. As DELETE should be considered permanent, trapline admins shouldn't need visibility on inactive entities. This would also add unnecessary complexity to queries with extra joins and filters.
sam-hunt commented 8 years ago

I hope noone ever has to revisit this code lol.