Skip to content

feature/AB#30415 - Modular Applicant Permissions - #2870

Merged
JamesPasta merged 27 commits into
devfrom
feature/AB#30415-modular-applicant-permissions-merge-fix
Aug 26, 2026
Merged

feature/AB#30415 - Modular Applicant Permissions#2870
JamesPasta merged 27 commits into
devfrom
feature/AB#30415-modular-applicant-permissions-merge-fix

Conversation

@plavoie-BC

@plavoie-BC plavoie-BC commented Aug 24, 2026

Copy link
Copy Markdown
Contributor

Pull request overview

Introduces modular applicant-management permissions across the web UI, application services, and default role grants.

Changes:

  • Adds granular permissions for applicant sections and operations.
  • Applies permission-aware tabs, controls, zones, and partial updates.

Reviewed changes

Copilot reviewed 32 out of 32 changed files in this pull request and generated 7 comments.

Show a summary per file
File Description
ApplicationBreadcrumbWidget/Default.cshtml Migrates applicant-view authorization.
ApplicantsActionBar/Default.cshtml Adds granular action permissions.
ApplicantOrganizationInfo/Default.cshtml Adds permission-aware information zones.
ApplicantHistory/Default.js Sends partial note updates.
ApplicantHistory/Default.cshtml Adds history-zone permissions.
ApplicantContacts/ApplicantContactsViewComponent.cs Migrates contact editing permission.
ApplicantAddresses/Default.js Restricts tracked address fields.
ApplicantAddresses/Default.cshtml Adds address fieldsets and permission model.
ApplicantAddresses/ApplicantAddressesViewModel.cs Renames address-edit capability.
ApplicantAddresses/ApplicantAddressesViewComponent.cs Checks modular address permission.
ZoneRequirementType.cs Defines zone requirement modes.
UnityZoneTagHelperService.cs Supports permission-only and toggle-only zones.
UnityZoneTagHelper.cs Exposes zone type configuration.
GrantApplications/Index.js Migrates applicant-link permission.
Applicants/Index.cshtml.cs Migrates page authorization.
Applicants/Details.cshtml.cs Migrates details-page authorization.
Applicants/Details.cshtml Gates applicant sections by permission.
ApplicantContact/EditModal.cshtml.cs Secures contact editing modal.
ExceptionCounterMiddleware.cs Changes notification environments.
ErrorCountingLoggerSink.cs Alters error sink execution.
AbpExceptionNotificationSubscriber.cs Changes notification environments.
GrantManagerMenuContributor.cs Migrates applicant menu permission.
PermissionGrantsDataSeeder.cs Grants new permissions to default roles.
en.json Adds applicant-permission labels.
DbMigrator/appsettings.json Changes local database credentials.
ApplicantAppService.cs Adds granular update, merge, address, and delete authorization.
ApplicantHistoryAppService.cs Adds history permissions and partial note persistence.
ApplicantContactAppService.cs Migrates contact-service authorization.
GrantApplicationPermissionDefinitionProvider.cs Registers modular applicant permissions.
SaveApplicantHistoryNotesDto.cs Adds modified-field tracking.
UnitySelector.ApplicantManagement.cs Defines applicant permission constants.
PaymentRequests/Index.js Migrates applicant-link permission.

@github-actions

Copy link
Copy Markdown

🧪 Unit Test Results (Parallel Execution)

Tests

📊 Summary

Result Count
✅ Passed 1013
❌ Failed 0
⚠️ Skipped 0

📄 HTML Reports

  • Merged Tests (HTML): Included in artifacts
    Generated automatically by CI.

@github-actions

Copy link
Copy Markdown

🧪 Unit Test Results (Parallel Execution)

Tests

📊 Summary

Result Count
✅ Passed 1013
❌ Failed 0
⚠️ Skipped 0

📄 HTML Reports

  • Merged Tests (HTML): Included in artifacts
    Generated automatically by CI.

1 similar comment
@github-actions

Copy link
Copy Markdown

🧪 Unit Test Results (Parallel Execution)

Tests

📊 Summary

Result Count
✅ Passed 1013
❌ Failed 0
⚠️ Skipped 0

📄 HTML Reports

  • Merged Tests (HTML): Included in artifacts
    Generated automatically by CI.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Introduces modular applicant-management permissions across the web UI, application services, and default role grants.

Changes:

  • Adds granular permissions for applicant sections and operations.
  • Applies permission-aware tabs, controls, zones, and partial updates.
  • Adjusts exception monitoring and local migrator configuration.

Reviewed changes

Copilot reviewed 32 out of 32 changed files in this pull request and generated 7 comments.

Show a summary per file
File Description
ApplicationBreadcrumbWidget/Default.cshtml Migrates applicant-view authorization.
ApplicantsActionBar/Default.cshtml Adds granular action permissions.
ApplicantOrganizationInfo/Default.cshtml Adds permission-aware information zones.
ApplicantHistory/Default.js Sends partial note updates.
ApplicantHistory/Default.cshtml Adds history-zone permissions.
ApplicantContacts/ApplicantContactsViewComponent.cs Migrates contact editing permission.
ApplicantAddresses/Default.js Restricts tracked address fields.
ApplicantAddresses/Default.cshtml Adds address fieldsets and permission model.
ApplicantAddresses/ApplicantAddressesViewModel.cs Renames address-edit capability.
ApplicantAddresses/ApplicantAddressesViewComponent.cs Checks modular address permission.
ZoneRequirementType.cs Defines zone requirement modes.
UnityZoneTagHelperService.cs Supports permission-only and toggle-only zones.
UnityZoneTagHelper.cs Exposes zone type configuration.
GrantApplications/Index.js Migrates applicant-link permission.
Applicants/Index.cshtml.cs Migrates page authorization.
Applicants/Details.cshtml.cs Migrates details-page authorization.
Applicants/Details.cshtml Gates applicant sections by permission.
ApplicantContact/EditModal.cshtml.cs Secures contact editing modal.
ExceptionCounterMiddleware.cs Changes notification environments.
ErrorCountingLoggerSink.cs Alters error sink execution.
AbpExceptionNotificationSubscriber.cs Changes notification environments.
GrantManagerMenuContributor.cs Migrates applicant menu permission.
PermissionGrantsDataSeeder.cs Grants new permissions to default roles.
en.json Adds applicant-permission labels.
DbMigrator/appsettings.json Changes local database credentials.
ApplicantAppService.cs Adds granular update, merge, address, and delete authorization.
ApplicantHistoryAppService.cs Adds history permissions and partial note persistence.
ApplicantContactAppService.cs Migrates contact-service authorization.
GrantApplicationPermissionDefinitionProvider.cs Registers modular applicant permissions.
SaveApplicantHistoryNotesDto.cs Adds modified-field tracking.
UnitySelector.ApplicantManagement.cs Defines applicant permission constants.
PaymentRequests/Index.js Migrates applicant-link permission.
Suppressed comments (2)

applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/Applicants/Details.cshtml:145

  • The true || bypass means the History tab is rendered regardless of History.Default. Remove the unconditional operand so the newly introduced view permission actually controls access to this tab.
                @if (true || await PermissionChecker.IsGrantedAsync(UnitySelector.ApplicantManagement.History.Default))

applications/Unity.GrantManager/src/Unity.GrantManager.Web/Views/Shared/Components/ApplicantAddresses/Default.cshtml:72

  • As above, this wrapper implicitly checks for a permission named PrimaryMailingAddress, which is undefined, so the mailing-address form is always suppressed. Bind it to the actual applicant-address permissions.
                <zone-fieldset id="PrimaryMailingAddress" class="row m-0 mailing-address-form ps-2" style="border-bottom:none;">

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@github-actions

Copy link
Copy Markdown

🧪 Unit Test Results (Parallel Execution)

Tests

📊 Summary

Result Count
✅ Passed 1013
❌ Failed 0
⚠️ Skipped 0

📄 HTML Reports

  • Merged Tests (HTML): Included in artifacts
    Generated automatically by CI.

@github-actions

Copy link
Copy Markdown

🧪 Unit Test Results (Parallel Execution)

Tests

📊 Summary

Result Count
✅ Passed 1013
❌ Failed 0
⚠️ Skipped 0

📄 HTML Reports

  • Merged Tests (HTML): Included in artifacts
    Generated automatically by CI.

@github-actions

Copy link
Copy Markdown

🧪 Unit Test Results (Parallel Execution)

Tests

📊 Summary

Result Count
✅ Passed 1090
❌ Failed 0
⚠️ Skipped 0

📄 HTML Reports

  • Merged Tests (HTML): Included in artifacts
    Generated automatically by CI.

@github-actions

Copy link
Copy Markdown

🧪 Unit Test Results (Parallel Execution)

Tests

📊 Summary

Result Count
✅ Passed 1090
❌ Failed 0
⚠️ Skipped 0

📄 HTML Reports

  • Merged Tests (HTML): Included in artifacts
    Generated automatically by CI.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 33 out of 33 changed files in this pull request and generated 6 comments.

@github-actions

Copy link
Copy Markdown

🧪 Unit Test Results (Parallel Execution)

Tests

📊 Summary

Result Count
✅ Passed 1090
❌ Failed 0
⚠️ Skipped 0

📄 HTML Reports

  • Merged Tests (HTML): Included in artifacts
    Generated automatically by CI.

@plavoie-BC
plavoie-BC requested a review from JamesPasta August 26, 2026 22:40

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 37 out of 37 changed files in this pull request and generated 3 comments.

Suppressed comments (1)

applications/Unity.GrantManager/src/Unity.GrantManager.Application/Applicants/ApplicantAppService.cs:708

  • UpdateApplicantIdAsync is exposed as a remote service and now only requires authentication ([Authorize]). This endpoint mutates application/applicant relationships and related records, so any authenticated caller could potentially reassign applicants to applications unless an explicit merge/assignment authorization check is performed in the method body.
    [RemoteService(true)]
    [Authorize]
    public async Task UpdateApplicantIdAsync(UpdateApplicantIdDto dto)
    {
        // Validate input
        if (dto == null)
        {
            Logger.LogWarning("UpdateApplicantIdAsync called with null dto.");
            return;
        }

        //Update Application
        var application = await applicationRepository.GetAsync(dto.ApplicationId);
        if (application == null)
        {
            Logger.LogWarning("Application not found for ApplicationId: {ApplicationId}", dto.ApplicationId);
            return;
        }

        var oldApplicantId = application.ApplicantId;
        if (oldApplicantId == dto.ApplicantId)
        {
            Logger.LogInformation("ApplicantId is already set to the requested value. No update required.");
            return;
        }

        application.ApplicantId = dto.ApplicantId;
        await applicationRepository.UpdateAsync(application);

        //Update ApplicationFormSubmissions
        await UpdateApplicationFormSubmissionsAsync(dto.ApplicationId, dto.ApplicantId);

        //Update ApplicantAgent records
        await UpdateApplicantAgentRecordsAsync(oldApplicantId, dto.ApplicantId, dto.ApplicationId);

        //Update ApplicantAddresses records
        await UpdateApplicantAddressRecords(oldApplicantId, dto.ApplicantId, dto.ApplicationId);
    }

@github-actions

Copy link
Copy Markdown

🧪 Unit Test Results (Parallel Execution)

Tests

📊 Summary

Result Count
✅ Passed 1090
❌ Failed 0
⚠️ Skipped 0

📄 HTML Reports

  • Merged Tests (HTML): Included in artifacts
    Generated automatically by CI.

@plavoie-BC
plavoie-BC marked this pull request as ready for review August 26, 2026 22:52
@sonarqubecloud

Copy link
Copy Markdown

@github-actions

Copy link
Copy Markdown

🧪 Unit Test Results (Parallel Execution)

Tests

📊 Summary

Result Count
✅ Passed 1090
❌ Failed 0
⚠️ Skipped 0

📄 HTML Reports

  • Merged Tests (HTML): Included in artifacts
    Generated automatically by CI.

@JamesPasta
JamesPasta merged commit e444256 into dev Aug 26, 2026
26 checks passed
@plavoie-BC
plavoie-BC deleted the feature/AB#30415-modular-applicant-permissions-merge-fix branch August 27, 2026 15:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants