[Admin dashboard] Newly created EMS users get a 403 when sending a ringdown, but actually create a new one with each click

sfbrigade / bats-server

Routed is an app to help ambulances direct non-critical patients to hospital emergency rooms with the most availability.

https://routedapp.org/

GNU Affero General Public License v3.0

18 stars 12 forks source link

[Admin dashboard] Newly created EMS users get a 403 when sending a ringdown, but actually create a new one with each click #227

Closed fwextensions closed 1 year ago

fwextensions commented 1 year ago

sign in to admin UI
create a new operational user
sign out
sign into the new user account
fill out a new ringdown
click Send 3 times

result: each click triggers a 403 response from the server and doesn't update the UI.

refresh the page

result: the ringdown status UI should appear.

click Mark arrived 3 times

result: after the third click, the ringdown status should update to the next step. it appears a new ringdown is created with each 403 response, and somehow the client cycles through each one as it progresses through the status flow.

I tried this after dropping the db and recreating it on the master branch, so don't think it's due to the model refactor.

fwextensions commented 1 year ago

@francisli you mentioned not being able to repro this. I just tried again with the same steps, after rebuilding everything on the new main branch, and got the same result. Each click on Send ringdown returns a 403.

francisli commented 1 year ago

@fwextensions ok, I know what's happening now... when you sign into the Admin console as batsadmin@c4sf.me, you'll by default be administering the Code for SF org. New users created in that org result in this behavior- the reason is that the Code for SF org is neither a HOSPITAL nor an EMS organization...

So, I think 403 is a correct response, but it is a bug that it is actually still creating the Ringdown...

Ykk2 commented 1 year ago

Would any of the following solutions be feasible for this issue?

1) remove the option to create an operational user under C4SF.

option 1: don't render out this option if a user is being created under C4SF.
option 2: render the option but show an error when creation of operational user is attempted under C4SF.

2) Allow creation of operational user but don't allow creation of ringdown.

in ringdowns.js, if we return line 114 instead it seems to solve this issue.

Apologies in advance if I'm missing the bigger picture.

canjalal commented 1 year ago

remove the option to create an operational user under C4SF.

I agree with this option. For a more general solution, should creation of operational users be limited to when the organization is of a specific type, e.g. hospital or EMS? Currently "Code for SF" is the only organization of type "C4SF"