Opening access to content search gave editors access to tools they did not have before

[laflannery]

Describe the defect

As a result of opening access to the content search tool to more users that are not super admins, we also inadvertently opened access to other tools these editors did not previously have. We should confirm if this is ok and if it is not remove this access.

I am testing with user "QA Content Publisher":

• Role:
  • Content creator - VAMC
  • Content publisher
• Section:
  • VA Boston health care

Tools they now have access to:

• VA Forms
  • On the main tab (VA Forms), I tested all of the available actions within the dropdown:
  • Break lock node results in an error message that says I do not have permission
  • Delete content results in an error message that says I do not have permission
  • Update URL alias results in an error message that says I do not have permission
  • Publish latest revision allows me to complete this action
  • All other tabs (Audit, Changed Filename, Changed Title & New/Deleted Forms) do not show me any results
• Content Audit Tools
  • Steve and I already talked about this but we think there might be a tab missing. When you first click "Content audit tools", a view is displayed, but no active tab is shown within the second level of tabs. We need to determine what this view is and if it shown be available to editors.
  • Should the tables view be available? The editor cannot do anything with this - there are not filters, there is not CSV download so it seems like it might just be noise?
• Promos
  • The issue I notice here is that in the directions at the top, there is a link to create a promo. However, there is no other way I can create a promo otherwise so this is a new functionality for me. Is there a concern editors are now going to be creating promos when they should not? Or going to be confused because we have shown them this?
• Alerts
  • This is the same as Promos, there is a link to create an alert, but again there is no other way I can create an alert otherwise so this is a new functionality for me. Is there a concern editors are now going to be creating these when they should not? Or going to be confused because we have shown them this?

AC / Expected behavior

• [ ] Review the questions/concerns above
• [ ] Determine if adjustments need to be made to permissions

CMS Team

Please check the team(s) that will do this work.

• [ ] Program
• [ ] Platform CMS Team
• [ ] Sitewide Crew
• [x] ⭐️ Sitewide CMS
• [ ] ⭐️ Public Websites
• [ ] ⭐️ Facilities
• [ ] ⭐️ User support

[swirtSJW]

Thanks for raising these Laura

• Content publisher being able to publish changes on va_forms by bulk operation is something we should address on that form. It should be perm restricted the way the other actions were and not allow it for any content that is not in the user's section. That is a defect with that View. I'll create a ticket.
• Promo blocks and alerts View should have it's scope restricted. I'll create a ticket.
• promo blocks and alerts seem to have picked up captions from the homepage heading views. May have picked up some inappropriate scope from those as well. I'll create a ticket
• The content audit view not having its own subtab is a pre-existing issue, unrelated to the perms being opened. I'll create a ticket.

[EWashb]

Thank you both @laflannery and @swirtSJW for looking into this! I appreciate yall