User with EventView for project cannot see deployment process change audit records

[MJRichardson]

As reported here: http://help.octopusdeploy.com/discussions/problems/50376

In the ListEventsResponder we do this:

var rule = new ScopedPermissionRequiredRule(typeof(Event), Permission.EventView);
...
rule.Customize(query) ...

This modifies the query to append SQL Where clauses which restrict Events to those with appropriate values for ProjectId and EnvironmentId. The DeploymentProcessModified event does have values for EnvironmentId, and so is being excluded.

This is tricky, as there are some cases where absence of a value for a scope means permission should be denied. In this case, it seems it should be granted.

Two possible options:

• Permissions declare how null values should be handled (i.e. granted or denied)
• Perhaps Event View is the only exception to the rule, and should have it's own Rule class, similar to Accounts.

Related Slack conversation: https://octopusdeploy.slack.com/archives/help-me/p1483930666000058

[SeijiSuenaga]

This bug affects variable and tenant changes as well.

• A user assigned to a team that is scoped only to specific projects and/or project groups is able to see project variable changes but not tenant changes in the audit log.
• If you add an environment or tenant to the team's scopes, all variable changes disappear from the audit log.
• If the team has no scope restrictions or only tenant restrictions, tenant changes become visible in the audit log.

Has there been any progress on this issue since January?

[MJRichardson]

User with EventView for project cannot see deployment process change audit records

[NickJosevski]

Release Notes: Fix for inconsistencies in EventView permission calculations.

[lock[bot]]

This thread has been automatically locked since there has not been any recent activity after it was closed. If you think you've found a related issue, please contact our support team so we can triage your issue, and make sure it's handled appropriately.