laws-africa / peachjam

Project Peach Jam
https://agp.africanlii.org
GNU General Public License v3.0
3 stars 0 forks source link

Check staff permissions #2192

Open niiroobiro opened 1 day ago

niiroobiro commented 1 day ago

We need to review the permissions that allow users to edit documents, especially the KL team making edits on Tausi.

longhotsummer commented 1 day ago

@actlikewill please describe the solution and the @Sandravaphilips can implement

actlikewill commented 1 day ago

Logged in users have the access to the 'Edit' button in the document detail view. That opens up the external document editing platform(indigo or caselaw) or local admin on the dropdown depending on the configuration. These both require that the user have the coredocument editor permissions. That permission is a little too high level to grant all editors. Instead we want to have those links only require that the user is a staff to view that button.

Image

Change the requirement for both of those to user.is_staff