Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom

Need a 'graceful landing' if someone goes to a screen they don't have access to while logged in. #4511

Open
2 tasks
cielf opened this issue Jul 14, 2024 · 6 comments · May be fixed by #4650
Open
2 tasks

Need a 'graceful landing' if someone goes to a screen they don't have access to while logged in. #4511

cielf opened this issue Jul 14, 2024 · 6 comments · May be fixed by #4650
Assignees
@therufs
Labels
Difficulty—Advanced High Priority

Comments

@cielf
Copy link
Collaborator

cielf commented Jul 14, 2024

Summary

If someone goes to a screen they don't have access to while logged in (usually through a link they have saved), take them to their own dashboard screen, with an error message.

Why

There are several people who have multiple roles. We're frequently seeing cases in bugsnag where people are trying to go to a screen they can't access in their current role. We'd like this to be gentler than a 500 error.

Details

If someone is logged in, but attempting to access a screen they can't, redirect them to the dashboard for their current role and show an error "That screen is not available. Please switch to the correct role and try again."

Recreation

Create a new user that is both a org admin and a partner.
Log in as that user
As the org admin, go to a report, and grab the link for that.
Switch to the partner role
Go to that link
Current: you get a 500 error
Desired: redirect to the partner dashboard with the above message.

(Similarly for the opposite case where you are going to a partner page from the org admin)

Criteria for completion

  • above behaviour across all screens
  • automated tests to demonstrate the behaviour
@cielf cielf added Help Wanted Groomed + open to all! Difficulty—Advanced labels Jul 14, 2024
@elasticspoon
Copy link
Collaborator

@cielf to clarify you mean something like:

I log in a partner and go to http://localhost:3000/reports/annual_reports/2023 and get hit with
image
?

@cielf
Copy link
Collaborator Author

cielf commented Jul 14, 2024 •
edited
Loading

I think the particular error that's coming up in that case is because they don't have a 'current organization" because they are signed in as a partner. I think that's going to be the kind of thing that currently happens on most of the relevant cases, but/and they shouldn't be able to access any of the views that require org_user or org_admin status when logged in as a partner. Does that help?

@awwaiid awwaiid modified the milestone: Tasks 2024 Jul 28, 2024
@therufs therufs linked a pull request Sep 12, 2024 that will close this issue
Draft
@therufs
Copy link

therufs commented Sep 12, 2024

Hey all,

With apologies for forging rashly ahead (I took a look at this to see if I could figure it out, and by the time I figured out I could, well, it was mostly done) I'm working on a draft for this one: #4650

I still have some tests to write, and per the reqs need to bubble up a slightly more helpful message than Access Denied, but put up a draft bc I find it it helpful to see in diff view (and so folks can chime in if I've totally misunderstood something here!)

@github-actions github-actions bot removed the Help Wanted Groomed + open to all! label Sep 12, 2024
@cielf
Copy link
Collaborator Author

cielf commented Sep 12, 2024

It might be a day or two before anyone has a chance to take a look at what you've done, but I've assigned it to you.

@therufs
Copy link

therufs commented Sep 12, 2024

thanks @cielf! I'll try to get the rest of my ducks in a row here meanwhile :)

@dorner
Copy link
Collaborator

dorner commented Sep 13, 2024

@therufs not sure I understand what's changed in that PR. As far as I can tell you renamed a method, but I don't really see how that fixes this problem?

# for free to join this conversation on GitHub. Already have an account? # to comment
Assignees

@therufs therufs

Labels
Difficulty—Advanced High Priority
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

WIP: check org membership before displaying report therufs/human-essentials
5 participants
@awwaiid @dorner @therufs @cielf @elasticspoon