decaporg / decaporg/decap-cms

"Delete published entry" button bypasses editorial workflow

Open
#5,650 6 comments 3 reactions 0 assignees View on GitHub
area: publishing area: ui/editorial-workflow type: feature
Dominant language
JavaScript
Stars
19.4k
Forks
3.1k
Avg merge
1d 14h
Merged PRs (30d)
9

Description

**Describe the bug**
Can't really tell if this is a bug or a feature, but it really does fell like a bug to me.
We have editorial workflow enabled, so that editors can create branches when suggesting changes and those changes can then be reviewed by someone else — this works great for us!

The issue seems to be when deleting something that's already published. Last Friday we needed to get rid of some old files and used the CMS for that. We were expecting — as we're using the editorial workflow — to have seen a PR and a branch. Just like when we add a new file.

But in fact, the changes were pushed directly to our `backend.branch`.
This is problematic because:
* Editors can mis-click the "delete published entry" button and not read the alert popup message
* Other editors will never be aware of this change as no entry is created in the workflow tab and they would have to go through GitHub's commit history to see it

Also, to make things worse, as we have some requirements for merging PRs, including having 1 approval from someone with write access:
* When a user with higher level permissions attempts to delete an entry from the CMS, this requirement will not be asked from GitHub
* When a regular user with write access attempts to delete an entry from the CMS, GitHub will complain it needs approval — although there's no PR whatsoever, instead, this error is shown:

> Failed to delete entry: API_ERROR: Required status check “cypress-run” is expected. At least 1 approving review is required by reviewers with write access.

To make it clear: **regular users, who are able to add files and suggest changes to existing file, are unable to delete entries**

**To Reproduce**
1. Visit a file collection in the CMS
2. Click on one of the entries
3. Click "Delete published entry" from the top bar
4. See the error (if regular user) / See the entry get deleted without a PR (if higher level permissions user)

**Expected behavior**
As mentioned above: since we have editorial workflow enabled, it would make sense for a PR to be created and a change to be listed under the workflow tab in the CMS. Which should then be approved _before_ the author could merge it.

**Applicable Versions:**

- Netlify CMS version: 2.15.30
- Git provider: GitHub
- OS: macOS 11.2.3
- Browser version: Brave v1.25.73
- Node.JS version: 12.17.0

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.