OHDSI / OHDSI/WebAPI

There is no proper messages for users with 'read restricted Atlas Users' role if an object is unavailable

Open
#2,324 7 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

security
Dominant language
Java
Stars
151
Forks
183
Avg merge
14m
Merged PRs (30d)
2

Description

Expected behavior

If a user with 'read restricted Atlas Users' role tries accessing an object they do not have read or write permissions, the user should get a proper message on the screen (e.g. "You do not have permissions to access this object")

Actual behavior

No messages at all (empty screen) or message about unavailable feature (You do not have access to this feature. For more information on how to get access please contact the System Administrator) which is not true. For PLP the page looks broken (there are design blocks but they are empty, no labels, no icons etc.)

Steps to reproduce behavior
  1. user1 creates an object (for example, a cohort pathways analysis)
  2. user2 has 'read restricted Atlas Users' role
  3. user2 does not have read or write access to the object from the step 1, but does have permissions to this type of objects (e.g. cohort pathways)
  4. user2 tries opening the object from the step 1

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No file or test is named. Reproduce the cohort pathways case with a user who has the “read restricted Atlas Users” role but lacks access to the object, then trace the permission response and PLP rendering path. Done means unauthorized objects show a clear permission message instead of an empty or feature-access screen, and the PLP is not visually broken.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
authorization
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.