pconrad
commented
10 months ago I believe it should also be possible to delete if the current user is a member of the course staff, not just for admins.
"There is a backend endpoint DELETE /api/course/staff?id=789 that will delete a member of the staff by the id as long as the current user is an admin, or as long as the current user is a member of the course staff."
I think this just means you have to also use ROLE_INSTRUCTOR, but I am not sure whether that has been implemented yet.
This is a good catch by @Joseph-Foster
For the time being, it's fine if this is an ADMIN feature only in this PR, but the team should add another issue to the backlog that can be done after ROLE_INSTRUCTOR is established in another PR.
The idea would be to change the acceptance criteria of the current issue to be:
- [x] There is a backend endpoint DELETE /api/course/staff?id=789 that will delete a member of the staff by the id as long as the current user is an admin.
And then there can be another issue with this acceptance criterion:
- [ ] The is a backend endpoint DELETE /api/course/staff?id=789 has been modified so that members of the course staff that have ROLE_INSTRUCTOR in the app may delete members of the course staff.
To be honest, there's a bit of ambiguity in the criteria here: should a user that is part of the staff but does not have ROLE_INSTRUCTOR (e.g. a TA or LA) be able to delete course staff?
My sense is that TAs/LAs should be able to add staff (that way, as an instructor, I can delegate adding all of the staff to a TA, which is really helpful in courses with large staff such as large sections of CS9 or CS16) but deleting should probably be something only the instructor (or an admin) can do.
And, one instructor shouldn't be able to delete staff from some course that they are not on the staff of.
As long as the separate issue is created and linked to, and the issue this one is linked to is modified, I think we can go ahead with the code as it is.
Joseph-Foster
Closes #22