Skip to content

In smartweb, only Manager can delete MessagesFolder (from collective.… - #24

Open
boulch wants to merge 1 commit into
mainfrom
avoid_delete_MessagesConfig_folder
Open

In smartweb, only Manager can delete MessagesFolder (from collective.…#24
boulch wants to merge 1 commit into
mainfrom
avoid_delete_MessagesConfig_folder

Conversation

@boulch

@boulch boulch commented Apr 22, 2026

Copy link
Copy Markdown
Contributor

…messagesviewlet)

Summary by CodeRabbit

  • New Features

    • Restricted deletion of messages configuration folders to Manager role only, enhancing access control and preventing unauthorized removal of critical message management resources.
  • Chores

    • Updated system version to 1041 with automated upgrade path support.

@coderabbitai

coderabbitai Bot commented Apr 22, 2026

Copy link
Copy Markdown
📝 Walkthrough

Walkthrough

This pull request introduces access control restrictions for MessagesConfig deletion by implementing a new workflow with permission mappings and an event-based subscriber that enforces Manager-only deletion rights. Changes span workflow definitions, configuration profiles, event handling, tests, and an upgrade path from version 1040 to 1041.

Changes

Cohort / File(s) Summary
Metadata and Documentation
CHANGES.rst, src/imio/smartweb/policy/profiles/default/metadata.xml
Updated changelog with deletion restriction feature and bumped profile version from 1040 to 1041.
Workflow Configuration
src/imio/smartweb/policy/profiles/default/workflows.xml, src/imio/smartweb/policy/profiles/testing/workflows.xml, src/imio/smartweb/policy/upgrades/profiles/1040_to_1041/workflows.xml
Added workflow tool configuration binding MessagesConfig content type to messagesconfig_workflow across three profiles.
Workflow Definitions
src/imio/smartweb/policy/profiles/default/workflows/messagesconfig_workflow/definition.xml, src/imio/smartweb/policy/profiles/testing/workflows/messagesconfig_workflow/definition.xml, src/imio/smartweb/policy/upgrades/profiles/1040_to_1041/workflows/messagesconfig_workflow/definition.xml
Defined messagesconfig_workflow with private state and permission mappings that restrict Delete objects permission to Manager role.
Event Subscriber
src/imio/smartweb/policy/subscribers.py, src/imio/smartweb/policy/subscribers.zcml
Implemented prevent_messages_config_delete subscriber that intercepts IObjectWillBeRemovedEvent and raises Unauthorized for non-Manager users attempting to delete MessagesConfig objects.
Test Suite
src/imio/smartweb/policy/tests/test_messages_config_delete.py
Added comprehensive integration tests validating workflow permission mappings, deletion blocking for non-managers, deletion allowance for managers, and subscriber handler behavior.
Upgrade Path
src/imio/smartweb/policy/upgrades/configure.zcml
Configured upgrade step from version 1040 to 1041 that applies the new workflow configuration to existing installations.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐰 A manager stands guard at the gate,
With workflows and roles to calibrate,
No deletion without the proper might,
The subscriber keeps permissions tight!
Hops forth with tests to set things right. 🔒

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 14.29% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and accurately summarizes the main change: restricting MessagesConfig deletion to Manager role only, which is reflected throughout the changeset.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch avoid_delete_MessagesConfig_folder

Comment @coderabbitai help to get the list of available commands and usage tips.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@CHANGES.rst`:
- Around line 8-9: The release note uses the wrong object name; update the
CHANGES.rst entry to reference MessagesConfig (the implemented and tested type)
instead of MessagesFolder so terminology matches the code and tests (change the
line "- In smartweb, only Manager can delete MessagesFolder (from
collective.messagesviewlet)  [boulch]" to use "MessagesConfig"). Ensure any
surrounding context or other mentions in CHANGES.rst that refer to
MessagesFolder are also updated to MessagesConfig to avoid ambiguity.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 08f3f848-2e78-4676-8f0a-d1a85913c469

📥 Commits

Reviewing files that changed from the base of the PR and between fc0a999 and 2ffcc3c.

📒 Files selected for processing (12)
  • CHANGES.rst
  • src/imio/smartweb/policy/profiles/default/metadata.xml
  • src/imio/smartweb/policy/profiles/default/workflows.xml
  • src/imio/smartweb/policy/profiles/default/workflows/messagesconfig_workflow/definition.xml
  • src/imio/smartweb/policy/profiles/testing/workflows.xml
  • src/imio/smartweb/policy/profiles/testing/workflows/messagesconfig_workflow/definition.xml
  • src/imio/smartweb/policy/subscribers.py
  • src/imio/smartweb/policy/subscribers.zcml
  • src/imio/smartweb/policy/tests/test_messages_config_delete.py
  • src/imio/smartweb/policy/upgrades/configure.zcml
  • src/imio/smartweb/policy/upgrades/profiles/1040_to_1041/workflows.xml
  • src/imio/smartweb/policy/upgrades/profiles/1040_to_1041/workflows/messagesconfig_workflow/definition.xml

Comment thread CHANGES.rst
Comment on lines +8 to +9
- In smartweb, only Manager can delete MessagesFolder (from collective.messagesviewlet)
[boulch]

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Align release-note terminology with implemented object type.

The implementation and tests target MessagesConfig, while this entry says MessagesFolder. Using the same term avoids ambiguity for operators.

✏️ Proposed wording tweak
-- In smartweb, only Manager can delete MessagesFolder (from collective.messagesviewlet)
+- In smartweb, only Manager can delete MessagesConfig (from collective.messagesviewlet)
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- In smartweb, only Manager can delete MessagesFolder (from collective.messagesviewlet)
[boulch]
- In smartweb, only Manager can delete MessagesConfig (from collective.messagesviewlet)
[boulch]
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@CHANGES.rst` around lines 8 - 9, The release note uses the wrong object name;
update the CHANGES.rst entry to reference MessagesConfig (the implemented and
tested type) instead of MessagesFolder so terminology matches the code and tests
(change the line "- In smartweb, only Manager can delete MessagesFolder (from
collective.messagesviewlet)  [boulch]" to use "MessagesConfig"). Ensure any
surrounding context or other mentions in CHANGES.rst that refer to
MessagesFolder are also updated to MessagesConfig to avoid ambiguity.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant