There seems to be a privilege issue with fetching managers, when creating an order.
Endpoint: GET https://api.dev.tolkevarav.eki.ee/translation-order/api/institution-users
Currently, I get error 403, if I have the create_project privilege and don’t have the manage_project privilege. Currently, this endpoint is used for fetching both the managers and the clients of a project, however from what I can see the privilege checks should be different for these. (project_role=manager/client)
For clients the “change_client” privilege is needed, but for managers it should be “create_order” OR “manage_order”.
There seems to be a privilege issue with fetching managers, when creating an order.
Endpoint: GET https://api.dev.tolkevarav.eki.ee/translation-order/api/institution-users Currently, I get error 403, if I have the create_project privilege and don’t have the manage_project privilege. Currently, this endpoint is used for fetching both the managers and the clients of a project, however from what I can see the privilege checks should be different for these. (project_role=manager/client)
For clients the “change_client” privilege is needed, but for managers it should be “create_order” OR “manage_order”.
Slack: https://pundar.slack.com/archives/C053FD55ATT/p1699783370231209
Relates to reassigning as well: https://github.com/keeleinstituut/tv-tolkevarav/issues/454
To-do: