A3 Providers and Courses

[busbyk]

Description

A3 provider, user, and course management in the admin panel.

Related Issues

Resolves #331

Key Changes

Main changes:

• Creates a Courses collection for external provider courses
• Creates a Providers collection to represent external providers and grant access to provider courses for users with provider relationships (see /docs/decisions/012-non-rbac-access-patterns.md)
• Creates an A3Management global that's used to indicate which global role is the "provider manager"
  • Restricts users with the provider manager role from changing the role selected here even if they have been given access via a global role (unless super admin)
• Global roles & super admin permission check enhancements / fixes: enables non-super admin, global-role-only users in the admin panel
  • accessByGlobalRoleReadOnly function for diagnostics global (pretty unrelated change but noticed this when addressing global role issues so leaving it in)
  • Fixes check to see if user is a "super admin" (i.e. can do every action on every collection/global). Was previously checking to see if the user had permission to do any action on any collection but we never noticed because there was only one global role. Updates usage in DuplicatePageTo.
  • Allows setting globals' slugs in role rules in addition to collection slugs for global roles only
  • Allows reading global roles if authenticated but keeping list view hidden from admin panel if user only has read access (from the authenticated read). This is to allow users with global roles to read their own role in their account view.
• Removes course-by-external-provider as an event type in favor of the Courses collection
  • Removes eventSubTypes in favor of courseTypes
  • Removes event blocks' eventSubType filtering
• Abstracts shared field configs from Events into their own factory functions
  • startAndEndDateFields
  • modeOfTravelField (makes this a multi-select and removes any as an option)
  • coordinatesWithMap
• Adds notification emails for Providers being approved (published) and Providers' approved courseTypes changing
• Users updates
  • Adds a Providers relationship to users which grants provider-user access
  • Updates Users collection access function to respect provider managers and provider users
  • Enables inviting users with Provider relationships, including for provider managers
• Hides Media and Documents from the nav if the user does not have explicit global or tenant role read access to them (used to show because those collections have public read for displaying on tenant websites but we don't want that in the admin panel)
• Restricts authenticated read on EventGroups, EventTags, Events
• Updated seed script accordingly
• Allows the slug field to be used for collections without a tenant
• Enables access-style functions that accept a User | ClientUser and check for specific permission (see changes under /utilities/rbac)
• Decision doc: /docs/decisions/012-non-rbac-access-patterns.md

Misc. small changes:

• Adds _status = published filter to /events/[slug] generateStaticParams
• Moves stateOptions to a constants file under the location field
• Re-uses the BlogList and BlogPost block thumbnails for the EventList and SingleEvent blocks since those thumbnails match the event blocks' UI too

Screenshots / Demo

Migration Explanation

Will add migration in #635

Future enhancements / Questions

The actual embeds will be in a future PR.

[github-actions]

Preview deployment: https://a3-courses.preview.avy-fx.org

[rchlfryn]

I took a very high level look at this. The review is mostly syntactically focused, but I did pull down everything and look at it. There are 2 things I think we should consider:

• Can we hide the docs or change the link on the dashboard?

• I really think we should do an events migration before merging this in and then another one for A3 events. I am worried we will miss something or had a bad migration.. Thoughts?

[busbyk]

I took a very high level look at this. The review is mostly syntactically focused, but I did pull down everything and look at it. There are 2 things I think we should consider:

• Can we hide the docs or change the link on the dashboard?

We have public A3 provider/courses docs there too so it feels appropriate to me. Thoughts?

• I really think we should do an events migration before merging this in and then another one for A3 events. I am worried we will miss something or had a bad migration.. Thoughts?

Since we're only adding things in all of these, I personally don't have any immediate concerns with doing one big migration for the events branch. But if it makes you more comfortable to do them progressively, I'm OK with that.

Since this is getting merged into events it logically makes sense to me to have a single migration for events -> main as well.

[rchlfryn]

We have public A3 provider/courses docs there too so it feels appropriate to me. Thoughts?

Maybe we just link to the A3 page? I think either way we need to build out our docs for A3 and maybe we can just wait to change it then.

Since this is getting merged into events it logically makes sense to me to have a single migration for events -> main as well.

I did a draft PR of a migration to see how we were doing, and I think we are okay to wait.

[rustynwac]

FWIW I think it's okay to have A3 documentation in the general Avy documentation.