[Permissions] Admin global role can't manage qualification awarding bodies

Open Beginner friendly
  • Is something wrong?
#97 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
76/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
django, python
Domain
authorization

Research direction

Find the GlobalRoles.PERMISSIONS definition and compare the ADMIN and DELIVERY_MGR entries with the four permissions required by the awarding body views. Read the permission sync task to confirm how these entries reach existing groups. Done means the required permissions are included for the intended roles and the sync grants them.

Written by the indexing model from the issue text.

Description

Summary

GlobalRoles.PERMISSIONS for ADMIN grants every *_qualification permission, but no *_awardingbody permission. QualificationAwardingBodyCreateView and its sibling views require jobtracker.add_awardingbody, and the matching change, view and delete permissions. So a non-superuser admin gets a 403 at /ops/qualifications/awardingbody/create/, and can't set up qualifications at all, because each one needs an awarding body.

Workaround, and why it's fragile

Adding the four permissions to the Global: Admin group by hand doesn't last. The daily task_sync_global_permissions cron resets every global group to GlobalRoles.PERMISSIONS, so the change is removed at 07:30 the next day. The only lasting downstream workaround is to grant the permissions to individual users.

Suggested fix

Add the four jobtracker.*_awardingbody permissions to the ADMIN entry in GlobalRoles.PERMISSIONS, and probably to DELIVERY_MGR, which already manages qualifications. Existing installs will pick them up from the next global permission sync.

Dominant language
HTML
Stars
6
Forks
4
No merged PRs in 30d

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from brainthee/CHAOTICA

All issues in brainthee/CHAOTICA

Similar issues

More Security issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.