Manage positions page implementation - #658
Conversation
|
|
||
| if not currentUser.isLaborAdmin: | ||
| allowedDepartmentIds = [d.departmentID for d in getDepartmentsForSupervisor(currentUser)] | ||
| if dept.departmentID not in allowedDepartmentIds: |
There was a problem hiding this comment.
You should be able to check dept in the returned list directly, without needing an intermediate list, like if dept in getDepartmentsForSupervisor.... Though I'm not 100% sure, as the function returns a modelselect, I think. Really, we do this check enough across all of the new functionality we should probably have an isDepartmentAllowed boolean method that takes a supervisor and department and does this logic internally
There was a problem hiding this comment.
There seems to be a lot of nuance for this implementation. From what I see, the cookie will "hold" the status, indicating that a user is a labor admin. This can be changed using an incognito window and by changing the debugging user from heggens to pearcej in the secret config. However, this only lets you test the CS department, which could be throwing the 403 error we want, since she does not have access to other departments anyway. I feel the previous implementation we have here works better because it leads down a rabbit hole
There was a problem hiding this comment.
Refactor the department check; use multiple functions with parameters for a query, or an if statement if the query returns anything. Within the getDepartments function.
…twareDevTeam/lsf into manage_positions_AD
This reverts commit 8444e0c.
…fixed capitilization in demo data
| userDeptData = request.form | ||
| supervisorDeptRecord = SupervisorDepartment.get_or_none(supervisor = userDeptData['supervisorID'], department = userDeptData['departmentID']) | ||
| @main_bp.route('/department/<org>/<account>/positions', methods=['GET']) | ||
| def managePositions(org, account): |
There was a problem hiding this comment.
there is a newly created departmentPortal.py controller I think anything route that doesn't stays on the three card department page should be in the departmentPortal.py but not mainroute. @BrianRamsay please correct me if I am wrong.
| print(f'Could not add user to department: {e}') | ||
| return "", 500 | ||
| if not g.currentUser.isLaborAdmin: | ||
| allowedDepartmentIds = [d.departmentID for d in getDepartmentsForSupervisor(g.currentUser)] |
There was a problem hiding this comment.
getDepartmentForSupervisor function returns all the departments the user is asscoiated meaning even if they don't exist in the department based on supervisordepartment table they can still see those departments because somewhere they have a lsf assigned to them a form history assigned to them. So we don't want to use that.
There was a problem hiding this comment.
through supervisor department, not just the ones they have a form history for,
| if dept.departmentID not in allowedDepartmentIds: | ||
| return render_template('errors/403.html'), 403 | ||
|
|
||
| positions = (PositionHistory.select() |
There was a problem hiding this comment.
getActivePositions in getpositions.py logic is a great place to either add your logic or refactor the existing getactivepositionlogic to return all position or active position base on parameters.
…rDepartmnet model to prevent all departments showing from labor status data
… and its departments
… out logic from main routes
MImran2002
left a comment
MImran2002
left a comment
There was a problem hiding this comment.
just these and I will be able to merge it
…k out word date so it says last revision, fixed the datatables issue that we were
4 participants
Fixes issue #644
Changes
Created a position route in the main route.
Queried data from the positions history to filter the active positions in history and pass to managepositions.html
Added managepositions.css, where some CSS logic is handled
Added managepositions.js, where the datatable logic is handled
Added logic to preserve allocation privacy
Testing
It is important to note that cookies for this website will retain the user's role as long as you run it; clear the cookies if you change the user's role. This will make it so that a user should only see the departments they should access when changing the department ID
Worked around the data and UI through inspection
Made sure the passed data is displayed by cross-checking on the database.
changed it to if a user changes the url to another department, th euser can not see other department's allocations if they are not a labor admin