feat(organizations): update page access permissions TASK-977 #5219
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Checklist
./python-format.sh
to make sure that your code lints and that you've followed our coding styleDescription
For various pages in account settings, we previously used a wrapper component to verify whether the user was the owner of their org before allowing them to access the page. With the organizations project, this permissions check needs to allow for checking multiple role options. We also need to be able to check whether an org is an mmo for the members page. This PR overhauls the old wrapper component to allow for these checks.
Testing
With Stripe enabled (and products synced), create a new user. Check the routes in the sidenav that were previously wrapped with
RequireOrgOwner
. There should be no difference with current behavior on main.Then turn on mmo_override for the org. Create a second user and then add them to the org via django admin. Logged in as the second user, check the routes again. You will have to enter the url manually for members, usage and org settings. You should be redirected to the account settings page, because the second user only has the org role of
member
. Finally, open the organization in django admin and check "is_admin" for the second user. Check the routes again. The admin should be able to view the members, usage and settings pages but still not the plans page.