Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Missing user details when editing a rotation #1820

Closed
matiasb opened this issue Apr 25, 2023 · 5 comments
Closed

Missing user details when editing a rotation #1820

matiasb opened this issue Apr 25, 2023 · 5 comments
Assignees
Labels

Comments

@matiasb
Copy link
Contributor

matiasb commented Apr 25, 2023

When updating as Editor a schedule in an organization with multiple users ( > 100), final schedule is displaying all users information (per #999), but we are still missing user details for users not available in that first page when editing the rotation:

rotation

Maybe we should get information for users in a schedule (which are usually not all users from an organization) from a specific schedule endpoint instead of the general user listing?

@matiasb
Copy link
Contributor Author

matiasb commented Feb 6, 2024

@maskin25
Copy link
Contributor

@matiasb the issue is that editors get 403 when try to fetch admins user data, is it by design?

In my local experiment IRM user is an Admin (pk: U96MQ72EFCFDI), and second@local is an Editor, if Iog in as second@local then I get 403 on /api/internal/v1/users/U96MQ72EFCFDI request

editors.are.not.able.to.fetch.admins.user.data.mov

@matiasb
Copy link
Contributor Author

matiasb commented Feb 14, 2024

Right, that's a possible issue. At some point we introduced a new schedule endpoint to get user information from there instead of requesting explicit user details. In any case, let me check for a work-around on the permission side which can be a simpler short-term solution (and eventually we can work on the frontend side to not require hitting the user details API?)

@maskin25
Copy link
Contributor

let's first check why editors can't load admin's profiles, then start switching to the new schedule endpoint

github-merge-queue bot pushed a commit that referenced this issue Feb 16, 2024
Related to #1820
Editor and Viewer roles have the user-settings:read permission, which
allows them to list users but with some of the data hidden. It makes
sense to allow the same thing for the detail endpoint, keeping the
viewable data restriction (fixing the referenced issue too).
@iskhakov
Copy link
Contributor

iskhakov commented Feb 20, 2024

[@maskin] all done, we need to check if it works
[Matias] plan to release it today

@matiasb matiasb closed this as completed Feb 20, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

5 participants