Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Hide navigation links in the admin tool that the admin does not have permissions to #432

Closed
GUI opened this issue Mar 15, 2018 · 1 comment

Comments

@GUI
Copy link
Member

GUI commented Mar 15, 2018

Currently within the admin tool, all admin users can see all the navigation links to all parts of the admin, even if they don't have permissions to view those pages. They won't be able to do anything on those page, since our permissions system forbid it, but it's confusing having these links present. This has become more relevant since we've had to remove the ability for admins to manage their own admin group (part of our ATO), so it's confusing still having links to the admin group part of the admin for everyone.

I think this functionality become broken in the API Umbrella v0.14.0 release when we shifted around some of the admin app implementation. Previously, we had hidden the admin navigation links as appropriate, but we were missing test coverage on this functionality and missed it during those upgrades.

@GUI
Copy link
Member Author

GUI commented Mar 15, 2018

Fixed in NREL/api-umbrella@ae960cf with tests to make sure we don't forget about this behavior again.

While looking into this, I also discovered an oversight in some of the API Umbrella admin permissions if an admin belonged to groups without any analytics permissions. This issue didn't affect any of our admin groups on api.data.gov, but still good to catch this before we did create such a group. This should be fixed in NREL/api-umbrella@a4569a6 (with more test coverage of these permissions).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant