Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] User Retains Manager Access to Collection After Role Revocation #6123

Open
1 of 8 tasks
abankhele opened this issue Nov 18, 2024 · 0 comments
Open
1 of 8 tasks
Labels

Comments

@abankhele
Copy link

abankhele commented Nov 18, 2024

Describe the bug
A user with a manager role, assigned as a manager for a specific collection, retains access to the "Manage Content" section and the collection even after their manager role is revoked from the system.

To Reproduce

  1. Steps to reproduce the behavior, including the results:
  2. Go to 'https://avalon-staging.dlib.indiana.edu/'
  3. Click on Manage Content and select a collection (e.g., Regression Testing 11/15 - editing).
  4. Under Assign Staff Roles, add a user with the manager role to the Manager field.
  5. Log in as the assigned user and confirm they can access the collection via Manage Content.
  6. As an admin, go to the Manage dropdown and click Manage Groups.
  7. Select the Manager group under System Groups.
  8. Remove the user from the Manager group.
  9. Log in again as the user and observe that they still have access to Manage Content and the collection.

Expected behavior
Once a user is removed from the Manager group, they should no longer see the Manage button in the navbar, nor should they have access to Manage Content or the collection.

Screenshots/Screen Recording
image.png
image.png

Environment (please complete the following information):

  • Device / platform : desktop
  • OS: macos
  • Browser [home, safari]
  • avalon-dev
  • avalon-staging
  • mco-staging
  • mco-production
  • demo

Done Looks Like

  • When a user is removed from the Managers group, they are removed from the staff role listing for each collection on which they are Manager (not demoted to Editor, as was the previous behavior)
    • Removing the user from collections after this action can be sent to a background job
  • If a user is removed from the Managers group but they are the sole manager on a collection, the application returns a message to the user indicating that they cannot be removed because of this
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

1 participant