search

rokwire / surveys-building-block

Building Block that manages surveys in the Rokwire Platform.
Apache License 2.0
0 stars 1 forks source link

[BUG] Remove permission requirements for survey APIs #29

Open dobromirdobrev opened 12 months ago

dobromirdobrev commented 12 months ago

Describe the bug An admin user is not able to load surveys when creating an event in the Admin app. This issue is related to: https://github.com/rokwire/illinois_admin/issues/397

To Reproduce Steps to reproduce the behavior:

  1. Go to https://api-dev.rokwire.illinois.edu/admin-web/#/
  2. Sign in
  3. Select "Illinois" application and hit "Continue"
  4. Click on "Events Calendar" -> "Create" event
  5. Click on "Event Follow-Up Survey"
  6. See the error

Expected behavior The surveys are loaded successfully.

Please remove the required permissions for the APIs:

So that these APIs do not require permissions similar to the Client APIs.

Additional context The problem is that the admin user does not have permissions to load the surveys: get_surveys, updated_surveys, delete_surveys or all_surveys. In result the API https://api-dev.rokwire.illinois.edu/surveys/doc/ui/index.html#/Admin/get_api_admin_surveys returns 403 Forbidden:

Request: GET: https://api-dev.rokwire.illinois.edu/surveys/api/admin/surveys?types=template.event_follow_up

Response: 

403 Forbidden

{
  "message": "Error validating request: error validating permission",
  "status": "forbidden"
}

The result would be the same when creating, updating or deleting a survey.