mitre / vulcan

A web application to streamline the development of STIGs from SRGs
https://mitre-vulcan-prod.herokuapp.com/
Other
58 stars 16 forks source link

Modifying a Project or Component Member with Admin Role Results in Unsolicited Change to a Component PoC #615

Open christopher-m-hosmer opened 8 months ago

christopher-m-hosmer commented 8 months ago

The PoC should never change unless a member with the "Admin" role explicitly changes the "Component Details"

Setup

Start New Project -> Fill out form

Create a New Component -> Fill out form

Scenario 1

Open Component: PoC set to the person that created the component (e.g. DOG) Navigate back to the Project and Select Members New Member -> select e-mail address for user not yet in Project -> select "Admin" as role (e.g. CAT) -> "Add User to Project"

BUG > Navigate to Components: added member with "Admin" role is incorrectly added as the PoC for the existing component (e.g. CAT)

Scenario 2

Open Component -> Update Details -> change PoC back to the person that originally created the component (e.g. DOG) -> Update Details Select "Members" while still in the Component Click "New Member" -> select e-mail address for user not yet in Project or Component (e.g. RABBIT) -> select "Admin" as role

BUG > Navigate to Components: added member with "Admin" role is incorrectly added as the PoC for the existing component (e.g. RABBIT)

Scenario 3

Vulcan is still in the Project Member view -> "Remove" the just added Project member (e.g. RABBIT)

BUG > The last added Project member with "Admin" role is incorrectly added as the PoC for the existing component (e.g. CAT) instead of it going back to the last set PoC (e.g. DOG)