-
Notifications
You must be signed in to change notification settings - Fork 103
Restrict editing of organizer general info to authorized users only #789
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: development
Are you sure you want to change the base?
Restrict editing of organizer general info to authorized users only #789
Conversation
Reviewer's GuideThis PR integrates organizer permission checks into the form lifecycle, disabling UI inputs for unauthorized users and preventing any saved changes if the user lacks the 'can_change_organizer_settings' permission. Sequence diagram for organizer general info edit permission enforcementsequenceDiagram
actor User
participant View as OrganizerUpdateView
participant Form
participant Permission as PermissionSystem
User->>View: Request organizer general info edit page
View->>Permission: Check 'can_change_organizer_settings' permission
Permission-->>View: Permission result
View->>Form: Generate form (fields disabled if no permission)
User->>View: Submit form
View->>Permission: Check 'can_change_organizer_settings' permission
Permission-->>View: Permission result
alt User has permission
View->>Form: Save submitted data
else User lacks permission
View->>Form: Overwrite changes with original data
end
View->>User: Return response
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hey @Gagan-Ram - I've reviewed your changes and they look great!
Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Hey Can you add screenshots of the changes |
@Sak1012 To test the PR, please create a Team that includes a member who does not have the "Can change organizer settings" permission. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM!
Currently, any team member can edit general info of organizer in ey-common (https://app.eventyay.com/tickets/common/organizer/openai/update)
The PR aims to restrict the edit permission to only those Team members who has appropriate permission ("can_change_organizer_settings" to be precise)
Changes made:
Summary by Sourcery
Restrict editing of organizer general info to only those team members with the can_change_organizer_settings permission by adding permission checks to form rendering and submission.
Enhancements: