Allow user to visit their own profile and set their own password.

[dt2patel]

What is the motivation for adding/enhancing this feature?

Allow user to reset their own password by logging into the users app and just view their own profile.

[rakshit-upadhyay214]

We can introduce a separate permission, USERS_LIST_VIEW, for viewing the users list, while assigning all users only the base permission USERS_APP_VIEW. This ensures that, by default, users can log into the app and access only the Me and Settings tabs.

Password reset will be allowed for all users with the USERS_APP_VIEW permission.

Users with USERS_LIST_VIEW will be able to view the users list and individual user details (tabs: Users, Permissions, Settings).

Access to the Permissions tab will remain the same as before; however, the tab will be visible only to users with the USERS_LIST_VIEW permission.

[rakshit-upadhyay214]

@dt2patel sir, please have a look at the above solution and let me know if I’ve missed anything.

[dt2patel]

I think this looks good other than that we should also factor in that if you have user app view, we will need to check on the server side that the get details API is only returning details for the currently logged in user. Or else people could modify the url to request data for different user ids

[rakshit-upadhyay214]

Sure sir, I'm aware of this case and will take care of it

[rakshit-upadhyay214]

Currently, I have added the USERS_LIST_VIEW permission only for the SUPER and COMMERCE_SUPER groups. We can further discuss which other groups, should have this access. Also, we need to ensure that the USERS_APP_VIEW permission is assigned to all users for whom we want to allow password reset.
PR for permission data: https://github.com/hotwax/hotwax-oms/pull/354

[ymaheshwari1]

Currently, I have added the USERS_LIST_VIEW permission only for the SUPER and COMMERCE_SUPER groups. We can further discuss which other groups, should have this access. Also, we need to ensure that the USERS_APP_VIEW permission is assigned to all users for whom we want to allow password reset. PR for permission data: hotwax/hotwax-oms#354

I have added comment around password reset feature to be dependent on USERS_APP_VIEW permission, as this is a basic permission for app usage so this should not be bound to password reset feature.

[rakshit-upadhyay214]

My first thought was that we need to provide this ability to every user, so USERS_APP_VIEW allows a user to visit only their own details and reset their own password only. It restricts access to other users' profiles.

If we want this ability not to be bounded only by the base permission, for the reset button we can also add a check for partyId, in case a user with only USERS_APP_VIEW logs in.

Other than this, users with USERS_LIST_VIEW can visit other users' details, but for resetting a password of other users as well, SECURITY_CREATE/ADMIN is required.