Permissions

[maxceem]

• During job editing Jobs Edit UI #12 (comment). Let's place the status field in read-only. Only BookingManager / Topcoder Admin can edit those fields.

• "Edit Job Details" button (Jobs Edit UI #12) should be only visible to the users who can edit jobs:
  

  • also the edit job page should be only accessible for the same users, and return "Access Denied" to other users if we try to navigate to the Edit Job page by other users

• "Edit Member Details" action:

  

  and "Edit Member Details button

  

  Should be only visible to BookingManager / Topcoder Admin users.

  • also the edit member details page should be only accessible for the same users, and return "Access Denied" to other users if we try to navigate to the Edit member details page by other users

• "Member Rate" on the View/Edit Member Details page is shown to all the users. It should only be shown to Booking Manager and Topcoder Admins. For other users it should be hidden.

• Hide Yes No buttons for Candidates list for user without access to update candidate status Hide Yes No buttons for Candidates list for user without access to update candidate status #38

[maxceem]

At the moment 3 points out of 5 are ready for QA in this ticket.

[maxceem]

@sandhiyakavi this is fully ready for testing on DEV.

There is only one case that is not ready and it's logged as a separate issue #112. I'm not sure if we could get it done for the 1.5 realease.

[sandhiyakavi]

@maxceem Below are some of the discrepancies found,

1. Connect Manager and users who are just member of the project(not created the job/project) are able to access the Edit Job page through URL . Not able to edit though

2. Similar issue with edit resource booking page.

3. Also I am able to edit the job with the user who created the job. though Edit Job detail button is not visible. Is that happening for specific users?

bandicam.2021-02-24.19-45-40-449.mp4

4. Also I am not getting the point why to hide member rate field in Edit resource bookings page if the page itself won't be visible for users other than BookingManager/Admin.(Though it's visible now).Please correct me if I am wrong.

[maxceem]

Thank you @sandhiyakavi

1. and 2. good catch, I will fix it.

3. Also I am able to edit the job with the user who created the job. though Edit Job detail button is not visible. Is that happening for specific users?

At the moment we cannot show this button for the users who create jobs because of the API limitation. I've created a separate issue to track this #112. It would be done after we create a new endpoint on API topcoder-platform/taas-apis#154. Not sure if this could be done in this release though.

4. Also I am not getting the point why to hide member rate field in Edit resource bookings page if the page itself won't be visible for users other than BookingManager/Admin.(Though it's visible now).Please correct me if I am wrong.

This is just to make sure we would never accidently show it. Even if tomorrow we would let regular users to edit resource bookings, the member rate would be still hidden for them. As this is a separate requirement we have a separate permission that controls it, so we would not accidentally leak it.