api-services-portal
api-services-portal copied to clipboard
bcgov
Access Manager - time wasted on invalid access requests
Story: As an access manager (Mark) I need to know when a request for access from an application is no longer valid because the application has been deleted by the consumer (Harley).
Trigger: A consumer (Harley) deletes an Application that has a pending request.
Value: Because an email notification is sent to Mark (Access Manager) they may log in and not see the pending request (as is current behaviour: pending request does not appear in the portal when the application has been deleted). This will cause confusion and may result in the Access Manager spending time and effort trying to find the cause of the notification but no request in the portal.
Elisa to investigate UX options, remove refinement label when solution has been identified
- One possible UX solution could be to include a message or notification on the access request page indicating that the application associated with the request has been deleted.
- Another possible solution could be to automatically remove any pending access requests associated with a deleted application. An email notification could be sent to Mark indicating that the access request has been automatically declined due to the deletion of the associated application.
@chrsamp could you review? :) Screenshot below
Display the error on the consumer's page when a consumer has deleted an application while the access request is still pending.
@elisafw-ux In addition to the above, we should also include a record under Activity to show that a Consumer has deleted an Application and revoked their consumer access. ATM there is no activity record, which adds to the confusion as it looks like it just disappeared.
+1 to Aidan's note about the activity record. In the error message, instead of saying "This request is no longer valid", can we make sure we mention that no action is required, or that they cannot approve the request as the associated application was deleted? Just to clarify that there really is nothing for them to do here? The consequence of the client application being deleted (no point in approving the request) is clear to us, but might not be immediately clear to whomever is managing access.
@elisafw-ux It is possible that the one Application has access to multiple Products; should each Product be a separate Activity, or should the one Activity record support multiple Products?
@ikethecoder I'd say one Activity record displaying the revoked access of multiple products. If we start creating separate activity records the UI could result being cluttered and confusing. I've learned that for activity feeds, if the actions were performed in the same timeframe, they are usually grouped as one activity.