978 plain user can't change his role.

[TahaKhanAbdalli]

fixes #978

[IanMayo]

@TahaKhanAbdalli - we really need to check they are a power user: rco-power-user

[IanMayo]

Aah @TahaKhanAbdalli - I've realised there's a higher level of security here. For the EditShow page, only rco-power-users should be able to Edit a user. The button should be disabled for other roles (or if there is no role).

Aah, but a non power-user could still manually navigate to http://localhost:5173/#/user/2/edit. So, we should disable the EditForm if the current user isn't a power-user.

[TahaKhanAbdalli]

Sure, I got your point. I will look into it tomorrow.

[IanMayo]

I'm happy to leave the linter issue to you @TahaKhanAbdalli

[IanMayo]

Aah, I've realised the issue isn't quite worded properly.

If I'm not a power user I can't change anyone's role.

I've just had a play, and we're deciding if the current record can be edited based upon if the current record is for a power user. The test should be for if I am a power user.

[TahaKhanAbdalli]

Oky.

[IanMayo]

Aah, I just changed my role from rco-power-user to rco-user. I've inspected the database, and I see that the role has changed (good) but my password has been erased (bad).

When I log out, I cannot log back in. Well, I can log back in - but I have to go through the password reset process (20300/20300).

I don't think we should erase the password when the role is changed.

[TahaKhanAbdalli]

Hi Ian,
First of all, sorry for the inconvenience. I am currently working on issue 979, which is the same as the one you are experiencing right now. I will try my best to fix it as soon as possible.
Thank you.

[sonarqubecloud]

Quality Gate passed

Kudos, no new issues were introduced!

0 New issues
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarCloud

[IanMayo]

Could you please double-check where we are with this issue @TahaKhanAbdalli ?

[TahaKhanAbdalli]

Sure.

[TahaKhanAbdalli]

The issue has been addressed. Now, if a user is an RCO Power User they have the ability to edit both their own profile and the profiles of other non RCO Power users. For users who are not RCO Power Users, they are restricted from editing any user profile, including their own. The edit button is disabled for ordinary users, and attempting to manually access the edit form is also restricted.

[TahaKhanAbdalli]

Approach changed to fix this issue in PR #988, therefore closing this PR.