Improvements to the Limited Staff role experience

[jmakowski1123]

The Limited Staff role needs some improvements to the user experience.

Currently, when a user with the Limited Staff role lands on a Studio Page in the new course-authoring MFE, they are blocked by a 403 error message, which contains json fields and is difficult to interpret. Minimally, the messaging could be improved to explain that the user is not granted access to Studio.

An enhancement can be made in the Studio experience such that users with this role do not see the "View this course in Studio" button. This will greatly reduce the chance of users trying to access parts of the platform that they don't have access to.

[github-actions[bot]]

Thanks for your submission, @openedx/open-edx-project-managers will review shortly.

[jmakowski1123]

@arbrandes @brian-smith-tcril Could you please add any technical requirements you'd like to see here?

[brian-smith-tcril]

In order to be able to fully test the Limited Staff role UX, I'd want to know:

• What pages are not accessible by Limited Staff?
  • If a Limited Staff user navigates directly to those pages (by entering a URL), what should they see?
  • Should they see the same thing on every page they cannot access?
  • Should they see the same thing as other roles that cannot access those pages?
• What UI elements on pages Limited Staff can access exist that navigate to pages Limited Staff cannot access?
  • Are they currently visible by limited staff?
  • Should they be hidden/disabled?

Answers to the previous questions would help inform my thoughts on this from a technical implementation perspective:

• If Limited Staff should see the same thing on every page they cannot access, and they should see the same thing as other roles that cannot access those pages, can we make a generic "you lack permission to see this page" page?
• If all UI elements that navigate to pages Limited Staff cannot access should be hidden/disabled, and the same is true for any other role that cannot access a page, can we write generic "hide/disable based on role" logic to wrap navigation elements in?

[jmakowski1123]

Limited Staff should not have access to any of the Studio pages in the course-authoring MFE. In the LMS, Limited Staff have the same permissions as Course Staff. Limited Staff should not see the button to "view this course in Studio" from the LMS. This will reduce chances for Limited Staff to land on Studio pages. If Limited Staff land on a Studio page via a url, they should see a message indicating they do not have access to the page. This message can be the same for any Studio url.

@0x29a as the contributing author for this role, is there anything you'd add here? https://github.com/openedx/edx-platform/pull/32570

[0x29a]

as the contributing author for this role, is there anything you'd add here?

No, @jmakowski1123, this description is correct. cc @Agrendalath

[itsjeyd]

@jmakowski1123 It looks like the following PRs are providing a partial implementation of this proposal:

• https://github.com/openedx/frontend-app-learning/pull/1436
• https://github.com/openedx/edx-platform/pull/35313

Could you please have a look at those and let us know what the next steps are from the product perspective?

CC @mphilbrick211

[itsjeyd]

@jmakowski1123 Could you please have a look at the comment above and let us know how to proceed?

(Happy to ping someone else from the product working group if you'd prefer. Let me know.)

[ali-hugo]

@itsjeyd I stand to be corrected, but I don't think that #1436: hide studio button for limited staff would need additional product review considering @jmakowski1123 has already "approved" this change simply by creating the current issue:

An enhancement can be made in the Studio experience such that users with this role do not see the "View this course in Studio" button. This will greatly reduce the chance of users trying to access parts of the platform that they don't have access to.

However, something that would need product input, is the messaging described in the following comment, but I imagine this would be covered in a separate issue.

If Limited Staff land on a Studio page via a url, they should see a message indicating they do not have access to the page. This message can be the same for any Studio url.

Let me know if there's anything I can do to help move this along.