Update Parent Group dropdown on edit group page to prevent users selecting groups they don't manage #166
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- only show groups that the current user can update so that they can't transfer to another group they can't update - prevent selecting one's own subgroup as a parent to avoid circular references
cmcfadden
approved these changes
May 1, 2024
jxjj
deleted the
feature/159-Bluesheet-managers-should-only-be-able-to-move-subgroups-to-they-own-or-not-be-able-move-subgroups
branch
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Resolves #159
Currently, Bluesheet Managers can set the parent group to any group. This can be problematic if it's set to a group the user don't have permissions to edit, or if the user chooses a group's own subgroup, creating a circular reference.
This updates the ParentGroup dropdown on the EditGroup page to show:
To support this, the
/api/groupendpoint is updated to appendcanCurrentUserpermissions info to each group. To avoid n+1 queries, theGroupController#indexbatch gets permission info rather than deferring to the GroupPolicy directly.On dev for testing.