Shelf-nu / shelf.nu

shelf is open source Asset Management Infrastructure for absolutely everyone.
https://shelf.nu
GNU Affero General Public License v3.0
1.78k stars 158 forks source link

Feat: Self service users should be able to assign/remove custody of an asset to themselves #1333

Open DonKoko opened 3 days ago

DonKoko commented 3 days ago

The title describes the feature pretty well. So lets do the following:

  1. Enable the Assign and Release custody actions for assets for self service users(both on asset page and bulk). The button title for self service users should be "Take custody" instead of assign.
  2. You will need to add a specific PermissionAction for those cases: 'assign-custody' and 'release-custody'. Before we were using PermissionAction.update so you will need to adjust that for all cases
  3. When the modal for custody opens, we need to have the selected user be disabled and already set to current user. We do that for booking create already.
  4. In the action, we need to double check the userId to prevent malicious actions. For self_service we need to make sure the userId we are receiving from the custody form is the same as the current user's id.
Joedon3 commented 1 day ago

I'm going to poke in here with my 2 cents. :) I think the permission to remove an asset from self custody should need to be explicitly allowed, or part of a role.