[Permissions] Only superusers can assign a framework agreement to a job

Open Beginner friendly
  • Is something wrong?
#110 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
75/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
django, python
Domain
authorization, backend

Research direction

Start with chaotica_utils/enums.py and inspect UnitRoles.PERMISSIONS for the Sales and Manager roles; then read jobtracker/views/job.py around assign_job_framework and the permission helper's global-permission setting. Confirm the role permission works for a unit member, and check the job widget's pencil visibility. Done when authorized unit roles can assign a framework and users without permission no longer see the pencil.

Written by the indexing model from the issue text.

Description

Summary

assign_job_framework (jobtracker/views/job.py) is protected by:

@job_permission_required_or_403("jobtracker.can_manage_framework_job", (Job, "slug", "slug"))

job_permission_required_or_403 defaults to accept_global_perms=False, so the check passes only on an object permission on the job, or on the permission held through the job's organisational unit. In practice nobody but a superuser has either:

  • The Sales Manager and Sales Member site roles include jobtracker.can_manage_framework_job (chaotica_utils/enums.py), but as a global permission, which this view ignores.

  • No unit role grants it. The Sales and Manager unit roles have the line commented out, and it uses a codename that doesn't exist:

    # "jobtracker.can_manage_frameworkagreement_job",

  • The pencil on the job's "Associated Framework" card is shown to everyone who can view the job, so everyone else clicks it and gets a 403.

Verified by reproducing it: a unit member with the Sales unit role fails user_has_unit_perms(user, "jobtracker.can_manage_framework_job", unit).

Impact

Sales and delivery staff can't link jobs to framework agreements, so framework days used, scheduled and remaining stay at zero, and the closed-framework and over-allocation checks never apply. Only superusers can do it, which defeats the role model.

Suggested fix

  • In UnitRoles.PERMISSIONS, replace the commented-out lines in the Sales and Manager unit roles with "jobtracker.can_manage_framework_job".
  • Optionally, pass accept_global_perms=True on assign_job_framework, so the site roles that already list the permission work as intended.
  • Hide the pencil unless user_has_unit_perms(...) passes, as other job widgets do.

Workaround

Create a custom unit role with only this permission. Custom role names are left alone by the daily task_sync_role_permissions_to_default. Then give that role to the relevant members of each unit:

from django.contrib.auth.models import Permission
from jobtracker.models import OrganisationalUnitRole
role, _ = OrganisationalUnitRole.objects.get_or_create(name="Framework Manager")
role.permissions.add(Permission.objects.get(codename="can_manage_framework_job"))

Granting the permission directly to a user on the unit doesn't last: OrganisationalUnit.sync_permissions() removes any per-user unit permission that the user's roles don't grant. Adding it to the built-in Sales role doesn't last either, because the daily sync resets known roles to their defaults.

Dominant language
HTML
Stars
6
Forks
4
No merged PRs in 30d

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from brainthee/CHAOTICA

All issues in brainthee/CHAOTICA

Similar issues

More Security issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.