Security role for composition not working correctly

Hello,

I have a 3 tier compostion: Consignment -> Pallet -> PalletItem. I’ve set up “read-only” user role that allows full control on Consignment entities and only READ to Pallet and PalletItem entities.

Editing a Consignment lists the Pallet children - the normal “Edit” button is now captioned “View” and when selecting a Pallet from the list the “View” button is highlighted and I can click to get the Pallet edit screen.

So far so good.

The PalletItems are listed correctly under my Pallet details (which, correctly, I cannot edit) and the “Edit” button is also now captioned “View”. BUT when I now select a PalletItem from the list the “View” button remains disabled and I cannot get to view any PalletItems.

By simply adding “Update” on the Pallet entity in the user role all will work correctly so it seems the UI is making some sort of incorrect assumption that viewing the PalletItem requires an update to its parent Pallet even though the UI is part way there by making the “edit” button a “View” button?

Any ideas or pointers as to how I can debug this or if its a known limitation (I cannot find any mention of this anywhere) greatly appreciated.

Andrew.

Hi, Andrew.
Unfortunately, we cannot reproduce the problem. Could you please provide more information about your problem? Which version of the platform do you use? If it is possible, could you share a small project in order to help us investigate the problem?

Hi Natalia,

I’ve managed to create a sub-project of my real project and using hsqldb created a test case which hopefully you should be able to open up and run and see the issue I see. I’m using platform 7.2.3 and Cuba Studio 13. My original project was using pre 7.2 security model but I migrated to the new model. This new project is using all new 7.2 defaults.

Default admin user is the stanadrd Cuba admin user. You can create a restricted user using role “Manager” to see the issue.

Can I send you a link to my project privately?
I hope the file is not too big!

Thanks
Andrew.

Yes, you can share your project in private messages.

Thank you for reporting the problem. We have created a GitHub issue.

Hello there,
There seems to be no activity on this issue. Was it successfully recreated and the cause identified?
Thanks
Andrew.