Only show Projects and Documents of User.division

florianm commented 2 years ago

Problem

Users from a Division are forbidden to view Projects and Documents of other Divisions.

[x] Project lists, Document lists: View: filter to project__program__division=User.division
[x] User.show_docs: Boolean whether to show docs (BCS users only for now)
[x] Index page: Show TODO component of portfolio only to BCS.
[x] Project and Document detail pages: check User.show_docs
[x] Annual Report: show only to Users in Report.divisions
[ ] Write functional tests for view restrictions (est 3 days)
[x] Update docs with explanation of view restrictions

All occurrences in the codebase are tagged with https://github.com/dbca-wa/sdis/issues/184. Affected are HTML templates and Python code.

florianm commented 2 years ago

Index page for a user without "Division" or a Division other than BCS:

Menu "Reports" hidden
Portfolio menu "My TODOs" (Documents pending updates or approval) hidden
Content "Reports" replaced by message "Currently, only BCS projects participate in annual reporting."

My SDIS Profile (or any staff profile):

Portfolio menu "My Tasks" (Documents pending updates or approval) hidden (wrinkle: Documents are hidden based on viewing User's Division, not on displayed User's Division)

Any project page:

Only tab "Overview" visible, tabs for Documents hidden (wrinkle: based on viewing User's Division, not on Project's Division)

ben3000 commented 1 month ago

This issue is stale.