Ensure a users own tasks are the only ones returned when the users role has View/My Tasks

app/models/miq_product_feature.rb

@@ -1,8 +1,10 @@
 class MiqProductFeature < ApplicationRecord
-  SUPER_ADMIN_FEATURE = "everything".freeze
+  SUPER_ADMIN_FEATURE   = "everything".freeze
   REPORT_ADMIN_FEATURE  = "miq_report_superadmin".freeze
   REQUEST_ADMIN_FEATURE = "miq_request_approval".freeze
-  TENANT_ADMIN_FEATURE = "rbac_tenant".freeze
+  MY_TASKS_FEATURE      = "miq_task_my_ui".freeze
+  ALL_TASKS_FEATURE     = "miq_task_all_ui".freeze
+  TENANT_ADMIN_FEATURE  = "rbac_tenant".freeze
 
   acts_as_tree
 

app/models/miq_user_role.rb

@@ -112,6 +112,10 @@ def tenant_admin_user?
     allows?(:identifier => MiqProductFeature::TENANT_ADMIN_FEATURE)
   end
 
+  def only_my_user_tasks?
+    !allows?(:identifier => MiqProductFeature::ALL_TASKS_FEATURE) && allows?(:identifier => MiqProductFeature::MY_TASKS_FEATURE)
+  end
+
   def report_admin_user?
     allows?(:identifier => MiqProductFeature::REPORT_ADMIN_FEATURE)
   end

app/models/user.rb

@@ -34,7 +34,7 @@ class User < ApplicationRecord
 
   delegate   :miq_user_role, :current_tenant, :get_filters, :has_filters?, :get_managed_filters, :get_belongsto_filters,
              :to => :current_group, :allow_nil => true
-  delegate   :super_admin_user?, :request_admin_user?, :self_service?, :limited_self_service?, :report_admin_user?,
+  delegate   :super_admin_user?, :request_admin_user?, :self_service?, :limited_self_service?, :report_admin_user?, :only_my_user_tasks?,
              :to => :miq_user_role, :allow_nil => true
 
   validates_presence_of   :name, :userid

spec/models/miq_user_role_spec.rb

@@ -222,6 +222,8 @@
   let(:tenant_admin_role) { FactoryBot.create(:miq_user_role, :features => MiqProductFeature::TENANT_ADMIN_FEATURE) }
   let(:report_admin_role) { FactoryBot.create(:miq_user_role, :features => MiqProductFeature::REPORT_ADMIN_FEATURE) }
   let(:request_admin_role) { FactoryBot.create(:miq_user_role, :features => MiqProductFeature::REQUEST_ADMIN_FEATURE) }
+  let(:report_only_my_tasks) { FactoryBot.create(:miq_user_role, :features => MiqProductFeature::MY_TASKS_FEATURE) }
+  let(:report_only_all_tasks) { FactoryBot.create(:miq_user_role, :features => MiqProductFeature::ALL_TASKS_FEATURE) }
   let(:regular_role) { FactoryBot.create(:miq_user_role) }
 
   describe "#super_admin_user?" do
@@ -238,6 +240,20 @@
     end
   end
 
+  describe "#only_my_user_tasks?" do
+    it "detects access limited to only the current users tasks" do
+      expect(report_only_my_tasks).to be_only_my_user_tasks
+    end
+
+    it "detects access not limited to only the current users tasks" do
+      expect(report_only_all_tasks).not_to be_only_my_user_tasks
+    end
+
+    it "detects no access to tasks" do
+      expect(regular_role).not_to be_only_my_user_tasks
+    end
+  end
+
   describe "#report_admin_user?" do
     it "detects super admin" do
       expect(super_admin_role).to be_report_admin_user