Sandboxed/Impersonated group managers can't see other users in the People tab
- Dominant language
- Clojure
- Stars
- 49.3k
- Forks
- 6.8k
- Avg merge
- 1d 13h
- Merged PRs (30d)
- 653
Description
**Describe the bug**
A group manager that has sandboxed access to any database can't see other users in the People tab in the Admin panel.
As @calherries found:
One strange thing I noticed with the query is that if a group manager has sandboxed permissions, they can't see any other users in the group. Perhaps we should make a separate issue for this?
Below is an example query that runs to load users in a group on this page. Note the clause core_user.id = 272. That restriction is included in the query if the user has any sandboxed permissions on their account.
```
SELECT "core_user"."id", "core_user"."email", "core_user"."first_name", "core_user"."last_name", "core_user"."is_superuser", "core_user"."last_login"
FROM "core_user" RIGHT JOIN "permissions_group_membership" ON "core_user"."id" = "permissions_group_membership"."user_id"
WHERE ("is_active" = TRUE AND "core_user"."id" = 272 AND "permissions_group_membership"."group_id" = 162)
ORDER BY "core_user"."is_superuser" DESC, "is_group_manager" DESC, lower("last_name") ASC, lower("first_name")
```
**To Reproduce**
Steps to reproduce the behavior:
1. As an admin, go to the People tab, create a group, add at least 2 users, promote one of them to group manager and restrict their access to any database to a sandbox.
2. Log in as the group manager and access the people tab. You can't see the other group members besides yourself.
**Expected behavior**
The group manager should see every other instance user in the People/People tab and the users in their group in the People/Groups tab.
**Severity**
This makes group managers useless for sandboxed managers. But there shouldn't be a lot of sandboxed group managers.
**Additional context**
Related to [#23246]()
Not sure why we are restricting the people tab in the admin panel for sandboxed users, it may be wise to investigate why we are doing it.
Contributor guide
Research direction
Start with the Admin panel People tab and the query shown in the issue, then compare the behavior with related issue #23246. Trace why sandboxed permissions add the current-user restriction and verify that group managers can see all instance users and members of their group when the fix is complete.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- clojure
- Domain
- authorization, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100