User not accessible as "Assigned To" but *IS* accessible as "Sub-assigned to", and then disappears from Contact

[zdmc23]

Observed on iOS 13.6

User not accessible as Assigned To but IS accessible as Sub-assigned to, and then disappears from Contact

Steps to reproduce:

1. Log into "dtappdemo" instance
2. Select No full name = new contact in header Contact
3. Observe that M.S. User is inaccessible (no link to click thru to Contact Details screen)
4. Click on Mike A. link
5. Observe that M.S. User is now accessible
6. Click on M.S. User
7. Observe that you can view Contact Details for M.S. User
8. Click back arrow
9. Click back arrow again
10. Observe that original Contact (No full name = new contact in header) has no detail for Assigned To or Sub-assigned to fields

For reference, please see video:
https://youtu.be/oR8lDkDiybo

[raschdiaz-zz]

Hi @zdmc23 @corsacca Working in this issue, We discovered some inconsistencies about the data that the user has permission to view.

For example:

• User: hansrasch
• D.T. Instance: dtappdemo.wpengine.com

This user does not have access to the contact 'Anthony Palacio (multiplier) (contact with id 62)' (according to website). But in the 'wp-json/dt/v1/users/get_users?get_all=1' end-point it returns me this contact.

In this development, We are using this users list (and the contacts list) to know if the user has access to this data, and add a links to redirect the user to contactDetail view (related issue #308).

We need the end-point only returns data that the user have access to, or add some property to indicate that the user does not have access to this contact.

We believe the same situation happens to the groups.

[corsacca]

@raschdiaz i need a little more help understanding your request.

The sub-assigned field is connected to the list of contacts. Any field ( subassigned, groups, etc ) should display the values of that field even if the user does not have access to the full record. I think this was implemented in #400 ?

So the sub-assigned field should display "Anthony Palacio (multiplier)" even if the user does not have access to the full record of "Anthony Palacio (multiplier)". What should happen if the user clicks on the value and does not have access to the record? I think just a screen that says "you don't have access to this record or this record is unavailable offline". Presumably the app is looking locally if the record is there, and if not: making an API call to the server to get the contact? The server will respond "Permission Denied" and the app display the message page.

The Assigned to field is connected to the list of users. Here too the field should display the value, even if the user is not returned from the users list.

Every endpoint only returns the data the user has access to.
Is your request that each value of the connection fields on a contact or group record have a flag saying if the user has full access to the connected record? (On the subassigned field: Anthony Palacio (multiplier) would be marked as "not full access" ?
I don't see a way to achieve this without slowing the requests down significantly.

Is there an issue/block in copying the behavior of the desktop website with a "Permission Denied" page?

[raschdiaz-zz]

Hi @corsacca , answering your questions:

"The sub-assigned field is connected to the list of contacts. Any field ( sub assigned, groups, etc ) should display the values of that field even if the user does not have access to the full record. I think this was implemented in #400 ?"

- Yes, this implementation was made in #400 issue.

So the sub-assigned field should display "Anthony Palacio (multiplier)" even if the user does not have access to the full record of "Anthony Palacio (multiplier)". What should happen if the user clicks on the value and does not have access to the record? I think just a screen that says "you don't have access to this record or this record is unavailable offline". Presumably the app is looking locally if the record is there, and if not: making an API call to the server to get the contact? The server will respond "Permission Denied" and the app display the message page.

- When the user taps the value of a contact he does not have access, the app will do the request and get an error response (and show a toast)

This is related to the #433 issue that @mikeallbutt created.

The app do the request to get contact data according to ONLINE/OFFLINE state. If app its ONLINE, it will do the request, if not, will get local data.

The Assigned to field is connected to the list of users. Here too the field should display the value, even if the user is not returned from the users list.

Yes, actually this is working like that.

Every endpoint only returns the data the user has access to.

- Well, as I show you in the above screenshots ('wp-json/dt/v1/ users/get_users?get_all=1' end-point), this doesn't happen.
This request response was made with my user 'hansrasch', that does not have access to the contact 'Anthony Palacio (multiplier)'.

Is your request that each value of the connection fields on a contact or group record have a flag saying if the user has full access to the connected record? (On the sub assigned field: Anthony Palacio (multiplier) would be marked as "not full access" ?

Add a new property, or don't return the data (We prefer this option)

I don't see a way to achieve this without slowing the requests down significantly.

Well, if its not possible to add a new property. Then you can filter this end-point? to only show data that user has access to.

Is there an issue/block in copying the behavior of the desktop website with a "Permission Denied" page?

No. but We want you check this flow (with the D.T team). Because we remember that someone mentioned the following flow: "When a user does not have access to the contact/group displayed in the detail view, don't add the 'link' behavior to this contacts/groups". This can avoid the user to enter a detail view (contact/group) that he does not have access. This flow can be more easily to implement. This can be worked related to the #433 issue

[corsacca]

@raschdiaz if there is a value for a field like "Anthony Palacio (multiplier)" we can not hide or not show the value. We must show it.
The user has access to the Name and ID, but not always the full record. And this is OK.

Instead of showing the toast that says "No permission to read contacts", the app should load a different screen (or a modal) that says "You don't have access to this record or this record is unavailable offline".

For now ignore the request: "When a user does not have access to the contact/group displayed in the detail view, don't add the 'link' behavior to this contacts/groups". We can come back to it later.

It is more important for us to have a good understandable message when the user tries to navigate to any record that they don't have access to. A use might navigate to a record from a typeahead field, a comment, a link, an old notification, etc.

[raschdiaz-zz]

Hi @zdmc23 @corsacca We can fix the problem related to navigation and add the 'link' feature to the 'assigned to' contact field. We have to do multiple tests, since this modification affects different user flows. We do the following test flows:

• Open filter the contact list view, tap a contact, see contact detail and return to the list view. The filters settings remain as they were (filtered or not).
• Navigation to multiple contact details (contact -> contact -> contact) on contact creation and detail modes.
• Open 'notifications' view, select a contact to see their info and do 'back' action. The app sent the user to the 'notifications' view.
• Navigation using back action (upper button and bottom button (android)).
• Open contact/group detail and go to another view (using bottom bar navigation). On returning the detail view is updated.
• Access another detail view (contact / group) from a detail view (contact / group).
• OFFLINE mode: when the user access to a contact/group info (detail view), app will persist it, if this contact/group does not exist in the current store data.

All this tests and fixes were made to contact/groups views.

https://drive.google.com/file/d/1d3QvgqrdJK-osswYogqdmh1I9k5pEdcP/view?usp=sharing