[User Story]: Allow users to share cases with other users for collaborative editing

chrisdburr commented 1 month ago

Role

As an assurance case builder

Desired Feature

I want to be able to add other users to edit or access an assurance case

Benefit

So that I can work collaboratively on the development or review of an assurance case.

Acceptance Criteria

GIVEN I have an assurance case as a user, which I have created AND I know the username or email of another TEA platform user WHEN I click on the Share/Export button in either the TEA case editor or the TEA case manager, I am provided with a modal that allows me to share the case with another user. AND I am able to give the user either read or write access. AND This user is then able to access the case from within their account by clicking on the 'Shared With Me' section.

Dependencies

No response

Technical Notes

Users who have a case shared with them, should not be able to further share this case with other people.
Having organisations/teams/admins and this more advance setting of permissions is something to address in the future.
For searching users to share a case with, the end user needs to provide their email (for all users). At the moment, GitHub accounts and TEA accounts are independent: if we need to link them, we can do it as part of a new user story.
We will create a new endpoint for sharing assurance cases: cases/<assurance-case-id>/sharedwith. This endpoint will only be accessible to the case creator, and supports the following operations:
- POST with a JSON body of [{"email": <email>, "read_only": true}, {"email": <email>, "read_only": false}], for sharing an assurance with other users (use the read_only field for enabling/disabling editing).
- PUT with a JSON body of [{"email": <email>, "read_only": true}, {"email": <email>, "read_only": false}], for modifying the permissions of users that have access to the case.
- DELETE with a JSON body of [{"email": <email>}, {"email": <email>}], for removing access to the case for specific users.
- GET will return a JSON document with the format [{"email": < email >, "read_only": true}, {"email": <email>, "read_only": false}], containing the users with access to the current case.
We will modify the existing api/cases/ endpoint. Now, when performing GET api/cases/?shared=true will return the cases shared with the user invoking the endpoint.
There are other behaviours we haven't defined yet: 1) Opening a read-only assurance case (what controls are enabled/disabled? Do we enable them to make a copy, in the Office 365 style?) 2) Concurrent editing of the assurance case (the legacy TEA platform had a locking mechanism. Do we need to port it?). I suggest we address these behaviours on different user stories.

Definition of Done

[ ] The feature fulfills all acceptance criteria.
[ ] The code is reviewed and meets team coding standards.
[ ] All unit, integration, and end-to-end tests are passed.
[ ] The feature meets accessibility standards set for the project.
[ ] The code passes the CI/CD pipeline quality controls (style and linting).
[ ] The feature is merged into the main branch.
[ ] The feature is deployed and functional in the QA environment.
[ ] The feature was demonstrated to the team and accepted by the product owner.

chrisdburr commented 1 month ago

@cptanalatriste, as a reminder @nbarlowATI and @mhauru implemented a simple case sharing feature in the original version of the assurance platform so it may be worth looking at their original solution.

cptanalatriste commented 1 month ago

@chrisdburr , I'm meeting with Markus today, to check what's already in place.

RichGriff commented 1 month ago

@cptanalatriste @chrisdburr

Work in progress on the frontend development for this user story.

Combined button for Share & Export
Modal pops up
User can export the assurance case to JSON
User can search and select users
User can 'Share' with selected users TODO - waiting on backend work

https://github.com/user-attachments/assets/05b7aad0-d5c6-467c-9188-0a5e1b880e4b

chrisdburr commented 4 weeks ago

Looks good, @RichGriff.

Would it be appropriate to add another event handler to the Download File button to close the modal once the file has been downloaded?

RichGriff commented 4 weeks ago

@chrisdburr I thought about this but figured users might still want to share the case with other user, as this mod has both options.

chrisdburr commented 4 weeks ago

@chrisdburr I thought about this but figured users might still want to share the case with other user, as this mod has both options.

No worries. This crossed my mind as well. No strong preference between the two, so happy to leave it as is.

cptanalatriste commented 4 weeks ago

@RichGriff I deployed to staging the backend services for this user story. Pleases check the PR description for technical details (https://github.com/alan-turing-institute/AssurancePlatform/pull/573) and let me know if further changes are needed

RichGriff commented 4 weeks ago

Updated UI for Sharing and also a new modal for Managing Permissions.

https://github.com/user-attachments/assets/4582623d-eaf2-4b5e-9333-8faa789683a9

@chrisdburr @cptanalatriste thoughts?

cptanalatriste commented 4 weeks ago

@RichGriff is looking great! Let us know when it's into staging, so we can give it a try

chrisdburr commented 4 weeks ago

@RichGriff is looking great! Let us know when it's into staging, so we can give it a try

Agreed. Thanks, @RichGriff.

RichGriff commented 4 weeks ago

@cptanalatriste is this feature in staging

We will modify the existing api/cases/ endpoint. Now, when performing GET api/cases/?shared=true will return the cases shared with the user invoking the endpoint.

Just want to test to see if users can see cases shared with them.

Update

Seems this hasn't been added - as a shared with my GitHub user and my shared cases come back empty.

cptanalatriste commented 3 weeks ago

@RichGriff , I build the endpoint for the "Shared with me" page. Please check this PR for technical details: https://github.com/alan-turing-institute/AssurancePlatform/pull/581

cptanalatriste commented 3 weeks ago

@RichGriff , per your request, the endpoint for case list now includes user permissions. Please see PR for technical details https://github.com/alan-turing-institute/AssurancePlatform/pull/583

RichGriff commented 3 weeks ago

This is all in staging have moved to review

@chrisdburr

chrisdburr commented 2 weeks ago

Can confirm it's working as discussed. Thanks 🙏

Just noting that a remaining task, which we can define in a new issue is how to handle the case where a user is trying to share a case with someone who is not an active user.

At present, they get an error that is likely to cause confusion because it is not explaining that the email is not registered as an active user (see below).

https://github.com/user-attachments/assets/46477b9f-b6e8-4b04-bdbd-6eba01a15c77

Will close this issue and open a new one as a bug.

alan-turing-institute / AssurancePlatform