search

HyphaApp / hypha

Submission management software for open calls
https://www.hypha.app
BSD 3-Clause "New" or "Revised" License
68 stars 38 forks source link

Applicants should not be able to see what staff member is lead on their application #3936

Closed wes-otf closed 2 months ago

wes-otf commented 4 months ago

Currently when a user submits an application, they can see who the staff lead is. In other cases we obscure the staff members name and it probably also makes sense to do so here as it's PII.

Screenshot 2024-05-22 at 11 21 05
wes-otf commented 4 months ago

to me the only people who really need this info would likely be staff, curious to hear your thoughts @frjo

frjo commented 4 months ago

We already hide staff names in comments for applicants so apparently it is important for OTF staff to stay anonymous. This is a logical extension of that.

When we implement this I think we should add a setting HIDE_STAFF_IDENTITY or similar. I suggest it is false be default but OTF would set it to true. This would then hide staff identity in comments, lead and any other place we find.

frjo commented 4 months ago

We should also add a function so we do not need to do user.is_apply_staff or user.is_finance or user.is_contracting. Maybe def is_employed(self):?

frjo commented 4 months ago

We could at the same time add a def is_external(self):.

All groups should belong to one of these criteria.

wes-otf commented 4 months ago

yeah I totally agree, sounds like a nice solution! I can toss something up quick.

wes-otf commented 4 months ago

basically have everything figured out for the new config option and having the lead/comment names hidden based on that, but one thing I'm logically struggling with is the activity tab, as activities like this are shown: Screenshot 2024-05-24 at 11 17 03 with how we currently handle visibility it seems like filtering this activity based on the HIDE_STAFF_IDENTITY may add another level of activity visibility complexity. For now should we just make this activity team visibility only and when visibility refactoring happens in #3915 consider how to reincorporate it? Open to any alternative ideas too

frjo commented 4 months ago

I see no problem with making this staff only.