avalonmediasystem / avalon

Avalon Media System – Samvera Application
http://www.avalonmediasystem.org/
Apache License 2.0
94 stars 51 forks source link

[BUG] User Retains Manager Access to Collection After Role Revocation #6123

Open abankhele opened 1 week ago

abankhele commented 1 week ago

Describe the bug A user with a manager role, assigned as a manager for a specific collection, retains access to the "Manage Content" section and the collection even after their manager role is revoked from the system.

To Reproduce

  1. Steps to reproduce the behavior, including the results:
  2. Go to 'https://avalon-staging.dlib.indiana.edu/'
  3. Click on Manage Content and select a collection (e.g., Regression Testing 11/15 - editing).
  4. Under Assign Staff Roles, add a user with the manager role to the Manager field.
  5. Log in as the assigned user and confirm they can access the collection via Manage Content.
  6. As an admin, go to the Manage dropdown and click Manage Groups.
  7. Select the Manager group under System Groups.
  8. Remove the user from the Manager group.
  9. Log in again as the user and observe that they still have access to Manage Content and the collection.

Expected behavior Once a user is removed from the Manager group, they should no longer see the Manage button in the navbar, nor should they have access to Manage Content or the collection.

Screenshots/Screen Recording

image.png image.png

Environment (please complete the following information):

Done Looks Like