Separate permissions for user and data management

[mtwestra]

At the moment the situation in the user roles and permissions is this:

• We have a checkbox 'administrator'
• If a user has this role, he/she can manage users, and delete data

This is an unwanted conflation of functionalities.

Ideal situation:

• There is no administrator checkbox, but a separate permission 'create, read, update, delete users'
• There is a separate set of permissions for data 'read data, update data, delete data'

[muloem]

We start with the separation of the Data Deletion functionality in this issue. In subsequent issues we will create the relevant user management functions as defined on the product design page https://github.com/akvo/akvo-product-design/blob/master/FLOW/Features/3-RolesAndPermissions/TechnicalDesign/ListOfRolesandPermissions.md

[muloem]

Test Plan: Data Deletion

Pre test Prep

Make sure you have two active users (one AdminUser and one RegularUser) defined and are able to login to a separate browser with each user. Also make sure you have a monitoring and non-monitoring survey that contains responses

Test 1: Check Delete Data permission

(execute AdminUser)

1. Select the Users > Roles and Permissions tab.
2. Select Add Role and define a role DataDeletionRole
3. Select the Delete Data permission from the list as well as View Folders and View Forms permissions. Save the changes
4. Select Edit for one of the existing roles. Delete Data should be included in the list of permissions.

Test 2: Assign the Delete Data permission

1. Using the RegularUser go to the Data > Inspect Data tab
2. Select one non-monitoring survey (containing responses) from the list and click Find
3. Verify that the Delete link is not visible in the Action column
4. Click on the Edit link for one of the responses
5. Verify that the Delete button is not visible (or is grayed out?) at the top of the dialogue box
6. Go to the Data > Monitoring tab
7. Select the monitoring survey and browse the responses
8. Verify that the Delete link is not visible in the Action column
9. Click View details on one of the entities
10. Verify that the Delete link is not shown in the Action column
11. As AdminUser select Users > Dashboard users tab and edit the permissions of the RegularUser chosen in the pretest preparation
12. Assign the role DataDeletionRole to the user and specify a folder (same as that containing the survey in step 2) to which this role is connected.
13. Save the changes
14. Using RegularUser, refresh the browser and go to the Data > Inspect Data tab
15. Select the non-monitoring survey and browse the responses.
16. Verify that the Delete link is visible in the action column
17. Click the Edit link and verify that the Delete button is visible and/or clickable.
18. Delete the response and ensure that it is actually deleted.
19. Go to the Data > Monitoring tab and select the monitoring form.
20. Verify that the Delete link is shown in the Action column
21. Click the View Details link and verify the Delete link is shown in the Action column in the popup box.

[rumca]

Most of the above test plan passes fine however there's an issue with viewing details on the data > monitoring tab for the Regular User (works for superAdmin users).

When a Regular User with the DataDeletionRole selects a monitoring survey on the data > monitoring tab and then selects view details a 403 is returned: GET http://uat1.akvoflow.org/rest/survey_instances?surveyedLocaleId=16929317 403 (Forbidden) further details Error: Access is Denied. Unable to identify object path or user

They can view & delete the individual forms on the data > inspect data tab so not quite sure what the problem is here? Maybe a similar config problem to earlier?

[rumca]

Issues resolved - closing :+1:

[rumca]

@iperdomo @jonase with release/1.8.5 (and presumably v1.8.4 though I thought it was working at the time) the only people that can currently delete data are super_admins. Regular users who have been assigned the DATA_DELETE permission see a 403 when they try and delete data:

Error: Access is Denied. Unable to identify object path or user

Note that the delete option is however shown correctly.

[rumca]

403 issue resolved and permissions now working as expected with release/1.8.5 (at least in the dashboard) :+1: