search

uclibs / scholar_uc_legacy

Source code for Scholar@UC up to version 3.x. Replaced by ucrate
Other
5 stars 1 forks source link

Proxy access removal is incomplete #1024

Closed newmanld closed 7 years ago

newmanld commented 7 years ago

Descriptive summary

As an owner, if I remove someone as my proxy, they can no longer submit new works on my behalf, but they can still edit works that they submitted as my proxy.

Expected behavior

When I remove someone as my proxy, they should lose edit access to works they earlier submitted, as well as lose the ability to edit works that they submitted as my proxy.

Actual behavior

A former proxy can no longer submit works on the owner's behalf, but can still edit works that they submitted as a proxy. They are still listed as an Editor on the Share tab if the owner edits the work.

Steps to reproduce the behavior

  1. As an owner assign a proxy
  2. As the proxy submit a work on behalf of the owner
  3. As the owner remove the proxy.

Related work

newmanld commented 7 years ago

See also #1025 and #1026

newmanld commented 7 years ago

One additional comment. When a proxy submits a work on behalf of an owner, the owner sees an entry on their dashboard that says that they proxy has transferred the work to them. (This may leverage the same code that is behind the option any submitter has on the dashboard to Transfer Ownership of a Work.) The proxy then is at the same time automatically made an editor on the work. So, it is theoretically possible that an owner could have assigned the proxy to be an editor on works which the proxy did not submit. When the owner removes a proxy, it may be impossible for Scholar@UC to distinguish at that point why they are an editor. Therefore I will ask the P.O.s to tell us if the owner should be prompted, when they remove a proxy, something like the following:

You are removing <proxy name> as your proxy. They will no longer be able to submit works on your behalf. Should they also be removed as an editor of your works? Yes/No/Cancel

(Cancel would presumably cancel the action of revoking the proxy.)

newmanld commented 7 years ago

See related card in Trello.

jamesvanmil commented 7 years ago

https://trello.com/c/vsFjyksS/59-as-a-submitter-if-i-revoke-someone-as-my-proxy-i-should-be-prompted-as-to-whether-they-should-also-be-removed-as-an-editor-of-wo

jamesvanmil commented 7 years ago

Per discussion with Linda proceeding without giving the user the option to cancel the Proxy removal, which is consistent with current behavior in both Curate and Sufia.

Clicking the X to remove proxy access from a user will trigger a model which will give the user the option of running a job to remove the user as editor of their works.

jamesvanmil commented 7 years ago

Okay to proceed as noted above, per discussion on 2017-02-16

hortongn commented 7 years ago

Tested this again now that the LDP::Gone error has been resolves and I verified that this bug has also been resolved (in both Sufia and our app). So marking as closed.

hortongn commented 7 years ago

Meant to comment and close a different issue. Re-opening this

hortongn commented 7 years ago

Just verifying that the behavior reported above still exists with Sufia 7.3.0.rc3. So this is still an issue that needs to be resolved.