search

seqcode / pegr

Platform for Eukaryotic Genome Regulation
MIT License
3 stars 1 forks source link

Incorrect GUI buttons shown: Guest user as a Guest role for a project *appears* to be able to delete sequencing run #215

Closed grettadarmstrong closed 1 year ago

grettadarmstrong commented 3 years ago

I was afraid to try this on Thanos, so I was able to do this on Hestia and see that at the end, I was not able to actually delete any data - which is great. However, I was able to go through the process as if I could. Presumably it fails at the very end because the 'delete' function is admin-only.

I am wondering if we can designate certain buttons and feature options throughout the software platform that are not visible at all if they are designated to be admin-only functions. Similar to how the 'Admin' console does not appear at all if the user does not have proper permissions.

[note: We might also want to discuss which role and which user is able to delete an entire sequencing run. I don't think just any admin should be able to do that. ]

Tested behavior on Thanos. Confirmed on Hestia.

A userID in the Guest role group: image

And only assigned as a Guest role in a Project: image

Will only be able to log in and view the one project, and mostly has only View permissions. It can view the one assigned project plus the software guide, and that is great, however when you dig into the project and open the samples and sequencing run information... image image

IF you go to the links for the Sequencing runs INSIDE the reports, those links appear to allow the Guest user/Guest role for the project to delete the entire run. image image image

And then it correctly fails, and outputs an error message which is great. Presumably because the 'delete' function is admin-only.

dshao commented 1 year ago

only allow admin to delete a sequence run.