Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Frontend: CRUD actions should be restricted according to admin roles #794

Open
wants to merge 5 commits into
base: dev
Choose a base branch
from

Conversation

disalechinmay
Copy link
Contributor

@disalechinmay disalechinmay commented Nov 10, 2023

Description

Frontend: CRUD actions will now be restricted according to admin roles.

  • Superadmin (Read, Create, Update, Delete)
  • Staff Admin (Read, Create, Update, Delete)
  • Admin (Read, Create, Update)
  • Create Only (Read, Create)
  • Read Only (Read)

Additionally there are following buttons which require the stated access levels:

  • Record Payment - Update Access
  • Send By Email - Create Access
  • Convert To Invoice - Update Access

Related Issues

#793

Steps to Test

  1. Create a readOnly admin user by navigating to the admin section
  2. Login using the readOnly user that you just created. (You can also use any existing readOnly user as well)
  3. Verify if you're able to create records like offers, leads, etc.

In the same manner, login using admins have other roles and verify respective CRUD actions access.
Note that we can also navigate to object create/update page directly using URL.
For example, to create an offer, we can navigate directly to <BASE_URL>/offer/create

Checklist

  • I have tested these changes
  • I have updated the relevant documentation
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the codebase
  • My changes generate no new warnings or errors
  • The title of my pull request is clear and descriptive

Additional Info

There is also this minor label issue that I've fixed on frontend/src/modules/InvoiceModule/Forms/InvoiceForm.jsx.
The label should have been 'Sent' but it was 'Pending' instead.

@disalechinmay disalechinmay changed the title Fix: ReadOnly users should not be able to create/update records Frontend: CRUD actions should be restricted according to admin roles Nov 11, 2023
@salahlalami
Copy link
Member

@disalechinmay thank you ,

could you please create new hooks called. : usePermission ,

then we can use it everywhere :

const hasPermission  = usePermission ();
// if the button for edit so will add  disable={!hasPermission('edit')} 

@disalechinmay
Copy link
Contributor Author

@salahlalami - Thanks a lot for the suggestion! I've made the necessary changes.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants