John Cardinal d254affc8b case 4720 - restricted roles get filtered work order items in report data, rendering and export ...

Opening a work order filters it for restricted users (TechRestricted,
SubContractor, SubContractorRestricted): only items they are scheduled on, and
on those only their own labour, travel and scheduling, and for some roles no
parts, units, expenses etc. Report data, rendering and export went through
WorkOrderGetPartialAsync, which filtered nothing for child types (security
review F27). Two causes:
- the partial fetch now applies the same filtering: the item only if the user
  is scheduled on it (checked in the database), then its details filtered; the
  existing per-item filtering moved unchanged into RemoveRestrictedUserItemDetails
  so both fetches share it;
- BizObjectFactory created WorkOrderBiz with UserType.Service for everyone, so
  in these paths a subcontractor was never treated as one; it now passes the
  user's real type (only the subcontractor flags depend on it).

Checked: report data for a restricted subcontractor on work order 1 went from
the whole item with parts to none; scheduled on an item, it gets the item
without parts or other users' labour. Full suite: 111 passed, 5 skipped, the
same 2 known failures.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-24 16:27:59 -07:00

354 KiB

Raw Blame History

View Raw