wmbeers / cmv-app

CMV - The Configurable Map Viewer - A community supported open source mapping framework built with the Esri JavaScript API and the Dojo Toolkit
https://demo.cmv.io/
MIT License
1 stars 2 forks source link

Users with multiple orgs see full list of editable alts, not just the expected alts of selected project #19

Closed wmbeers closed 4 years ago

wmbeers commented 4 years ago

How often can you reproduce it?

Description:

If all of the following are true:

  1. A user has multiple orgUser accounts with project editing authority
  2. Follows a link from the EST to edit a given project (index.html?editProject=1234)
  3. The orgId of the project isn't the same as the orgId of their first (by PK, apparently) orgUserId

Then instead of seeing the list of alternatives for project 1234, they see all editable alternatives for that district. This is because of code in the callback function from MapDAO.getEditableAlternativeOfProjectList that changes the currentAuthority to match that of the project, which subsequently (via subscription on the currentAuthority observable) triggers a call to the listProjectAlts method.

Steps to reproduce:

  1. Log on as a user with multiple org user accounts
  2. Find a project with multiple editable alternatives, for an organization that is not the same as the org associated with the user's first orgUser account
  3. Follow the link to edit the project

Expected results:

The list of alternatives for the project is shown

Actual results:

All editable alternatives of all projects for the org associated with the project are shown.

wmbeers commented 4 years ago

Code verified in production.