Skip to content

[feature] Show shared objects for org-wide batch commands as read-only to non-superusers #1439

Description

@dee077

Is your feature request related to a problem? Please describe.
Org-wide batch commands (organization=null) created by superusers are currently visible to all organization managers/admins via the REST API. However, there is no proper support in openwisp-users for showing shared objects as read-only to non-superusers. This means org admins can see batch commands they didn't create and shouldn't have full access to.

Describe the solution you'd like

  1. Implement shared object read-only support in openwisp-users so non-superusers can see objects with organization=null but cannot modify them.
  2. Once [feature] Allowed read only access of shared objects to non-superusers #238 openwisp-users#444 merged, remove the temporary queryset filter in BatchCommandListView and BatchCommandDetailView that excludes organization=null for non-superusers.
  3. Ensure org-wide batch commands are visible as read-only to org managers, while keeping create/update/delete restricted to superusers.
  4. Hide sensitive data such as primary keys, error logs, and other restricted information from non-superusers for objects not in their managed organizations.

Describe alternatives you've considered
PR #1395 implements the Mass Command model and REST APIs with a temporary queryset filter (with TODO comments) to exclude organization=null commands for non-superusers. This workaround will be removed once openwisp-users properly supports shared objects as read-only.

Additional context

Note: Do not pick this up until the related issues/PR are closed.

Metadata

Metadata

Assignees

No one assigned

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions