unauthorized user could delete requirement using the HP ALI plugin

[yduan123]

HP ALI version: 3.13.133.193
Intellij Version: 14.0.3

Users cannot delete requirement in QC (via browser) due to limited privilege. But the same user was able to delete requirement in Intellij using the plugin, after confirming the delete prompt.

[janotav]

Is the workflow involved? If the enforcement is done via workflow, it cannot be supported by the plugin, which is not workflow-compliant.

[yduan123]

Not sure if any workflow is involved. At least no explicit/customized workflow was configured. The user only has a standard QC role of "Tester" and is not supposed to perform any delete.

[janotav]

Can you please list the QC/ALM version and edition? Thanks.

[yduan123]

HP Application Lifecycle Management
Installation Details:
Product version 11.52.536
Patch level 4

[janotav]

I'm not able to reproduce this on a very similar setup (11.52.572). Namely:

1/ if user only has viewer role, the deletion from Intellij fails (after dialog confirmation, insufficient permissions are reported and requirement is not removed)

2/ if user has "QATester" role, he is able to remove requirement both in QC and Intellij

As a possible enhancement the appropriate action could be disabled rather than failing. It's not what you are reporting though. Are you sure that in your case it is not disabled/disallowed by a workflow permission/mechanism?

[yduan123]

Thanks. I'll ask QC admin about workflow. I changed my QC role to "Viewer" and got the following error when attempting to delete requirements using the plugin (I think it's the same as you test 1/) -
The user #### was denied access to perform the operation on the object requirement(id=####) due to the following reasons: The permission setting for operation Delete doesn't allow user to perform the required operation on the secured object; The user is not the owner of the entity

Could you please also check whether you can delete requirement with "Tester" (not QATester) role?

[janotav]

Indeed, it's the error that I saw too and that's what is currently expected.

There is no "Tester" role on the freshly created project that I used. Let's wait for the additional info from your QC admin.