Skip to content

[feature] Show shared objects for org-wide batch commands as read-only to non-superusers #1439

Description

@dee077

Is your feature request related to a problem? Please describe.
Org-wide batch commands (organization=null) created by superusers are currently visible to all organization managers/admins via the REST API. However, there is no proper support in openwisp-users for showing shared objects as read-only to non-superusers. This means org admins can see batch commands they didn't create and shouldn't have full access to.

Describe the solution you'd like

  1. Implement shared object read-only support in openwisp-users so non-superusers can see objects with organization=null but cannot modify them.
  2. Once [feature] Allowed read only access of shared objects to non-superusers #238 openwisp-users#444 merged, remove the temporary queryset filter in BatchCommandListView and BatchCommandDetailView that excludes organization=null for non-superusers.
  3. Ensure org-wide batch commands are visible as read-only to org managers, while keeping create/update/delete restricted to superusers.
  4. Hide sensitive data such as primary keys, error logs, and other restricted information from non-superusers for objects not in their managed organizations.

Describe alternatives you've considered
PR #1395 implements the Mass Command model and REST APIs with a temporary queryset filter (with TODO comments) to exclude organization=null commands for non-superusers. This workaround will be removed once openwisp-users properly supports shared objects as read-only.

Additional context

Note: Do not pick this up until the related issues/PR are closed.

Metadata

Metadata

Assignees

No one assigned

    Fields

    No fields configured for Feature.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions