diff --git a/devdocs/specs/core-roles.txt b/devdocs/specs/core-roles.txt index ab78dc58..69b35e2e 100644 --- a/devdocs/specs/core-roles.txt +++ b/devdocs/specs/core-roles.txt @@ -97,6 +97,11 @@ nothing to do with business stuff or actual business data - EditOwn is originally intended to deal with limited rights users who are not supposed to see other workorders but the ones they are supposed to work on. - Original intention is they can create items necessary to fill out their own workorders - It means a workaround on every single object and list coming from the server to check if they own an object in addition to their basic rights. + - Does it? Or is this just about workorders. + - Workorder selection lists don't need to check rights, everyone has rights to them + - If they are editing an existing workorder they can't see a list of clients so that is kept private + - Parts and bits to fill in a workorder are not private data if you need them to fill it out so + - People are most concerned with hiding profits and private competitve data from subcontractors - Is this the best way to handle the intended use-case which is to have a tech user with limited rights to only see their shit and fill out workorders? - Is this also a way to handle client users? - What happens when a user is only allowed to see their own objects and has to choose a labor that they didn't create? @@ -104,7 +109,7 @@ nothing to do with business stuff or actual business data - - TechFull user should be edit own but can't navigate to inventory form to test when not going directly from a link ?! + - Widgets and TechFull user should be edit own widget but can't navigate to inventory form to test when not going directly from a link ?! - Same issue with BizAdminLimited and read only, can't go to inventory at all to view list - rights must be set for only full access to even view the inventory page. - RETEST RIGHTS after this because could not test with this issue