hypothesis / hypothesis/client

Don't allow the authoring of an annotation in a group the user is not authorized to write to

Open
#2,338 0 comments 0 reactions 0 assignees View on GitHub
feature request
Dominant language
Mustache
Stars
730
Forks
224
PR merge metrics
No merged PRs in 30d

Description

This issue is only applicable to restricted groups—the only case at present that a Hypothesis user may see content in a group but not write to that group.

This issue applies in the case that:

* A user is viewing content within a restricted group (i.e. the restricted group is the current "focused", or selected, group)
* The user is logged in but is not a member of the restricted group
* The user highlights some text and clicks "Annotate"

## Current Behavior

The client will allow the creation and population of a new annotation, and the publish control (button) is enabled. However, when the user submits the new annotation:

The backend is (correctly) responding with an error because this user is not authorized to write annotations to this group.

## Expected Behavior

Needs clarification. What _should_ happen in this scenario? My hunch is that this was a loose end during the groups implementation phase that wasn't tied up. Some possible options (not vetted for awesomeness) include:

* An error message
* Disabled post button
* Changing focused group on the author's behalf
* Disabling the `Annotate` button in the annotator toolbar

None of those sound like great ideas immediately, at least in isolation.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.