Restrict access to publications based on the user's organisation #2354

mtaylorgds · 2024-10-04T13:06:35Z

What

Prevent non-GDS users from accessing editions that are "owned" by other organisations. GDS users will still see all editions.

Introduces the concept of editions having an array of owning organisations, as represented by an array of those organisations' slugs.

The organisation slug is used as it is the only information we have to tie a user to an organisation (via the user's organisation_slug).

This is part of our work to open up Mainstream Publisher to users outside of GDS.

This PR does not include assigning any content items to organisations—that will follow as a separate piece of work. This means that, for now, turning on the feature toggle will result in non-GDS users simply seeing no content in Mainstream Publisher.

Feature toggle

The changes are behind a new feature toggle restrict_access_by_org, which defaults to off.

Trello

Trello card

⚠️ This repo is Continuously Deployed: make sure you follow the guidance ⚠️

app/models/edition.rb

test/functional/editions_controller_test.rb

test/functional/legacy_editions_controller_test.rb

test/models/edition_test.rb

Prevent non-GDS users from accessing editions that are "owned" by other organisations. GDS users will still see all editions. Introduces the concept of editions having an array of owning organisations, as represented by an array of those organisations' slugs. The organisation slug is used as it is the only information we have to tie a user to an organisation (via the user's `organisation_slug`). This is part of our work to open up Mainstream Publisher to users outside of GDS.

test/functional/editions_controller_test.rb

test/functional/legacy_editions_controller_test.rb

Instead of checking a user's `organisation_slug` field, which might be subject to change if the organisation name changes, use the `organisation_content_id` field, which should be resistant to such changes. The `organisation_slug` field has been around longer, and there are some users in the database that have an `organisation_slug` field set but not an `organisation_content_id`, however, all such users appear to be "suspended" in Signon (even if their accounts are not disabled in Mainstream Publisher). Adds a couple of extra tests to ensure that when a user has no organisation set, that they cannot see editions when the `restrict_access_by_org` feature toggle is enabled.

Add feature toggle "restrict_access_by_org"

c182c87

mtaylorgds force-pushed the 345-restrict-access-to-publications-based-on-the-users-organisation branch from be6812c to 6fd3505 Compare October 4, 2024 13:22

mtaylorgds marked this pull request as ready for review October 4, 2024 13:58