Compliance Auth Group Fixes and Changes

[awf-dbca]

Number of fixes and adjustments to Compliance Management, mainly pertaining to allocated access groups.

Changes included*:

• Re-enabling the allocated_group column for the SanctionOutcome model
• Reviewing each stage of a number of object workflows and ensuring that all objects have an allocated_group value while they are open
• Removing the organisation request link from the Compliance Management nav links
• Ensuring that only users assigned to a given object can make changes to said object (except inspections, where a member of an inspection team can also make changes at the inspection's initial stage)
• Fixing the assignment drop-down display and functionality so that users can assign themselves or others to a given object
• Adding a dedicated inspection officer group, works the same as the officer group but specific to inspections (officers cannot change inspection details unless they are part of the inspection's inspection team)
• Adding environment variables to control access among groups - by default all groups sharing the same group name (e.g. officer) will have their objects editable by users belonging to all of those groups regardless of region/district
• A region lock env var is available so that only users in groups belonging to specified region/district can make changes to objects belonging to a given group
• A super group env var is available for when the region lock is enabled but some groups (with no specified region/district) need to be able to alter objects belonging to groups with same name (in the case of where regions are specified, those groups can alter objects with that region regardless of district)
• Fixed inspection team search/add/remove
• Added server-side authentication to the related item functions
• Added server-side validation for all workflow processes pertaining to Inspections, Offences, Sanction Outcomes, and Legal Cases

*Where referring to objects, referring to Inspections, Offences, Sanction Outcomes, and Legal Cases

The changes should allow for users to choose how group users are allowed to interact with objects with regards to their specified regions and districts. A number of issues that could lead to stale objects have also been fixed, as well as some minor security issues.

Note: regardless of auth options, officer and manager region and district groups must be specified to create and forward objects. For example, to create a legal case in the kimberley region, an officer kimberley region group must exist (it can be empty if region locks are disabled, however)

[xzzy]

Sensitivity Check Completed