Feat: Self service users should be able to assign/remove custody of an asset to themselves
The title describes the feature pretty well. So lets do the following:
- Enable the Assign and Release custody actions for assets for self service users(both on asset page and bulk). The button title for self service users should be "Take custody" instead of assign.
- You will need to add a specific PermissionAction for those cases: 'assign-custody' and 'release-custody'. Before we were using
PermissionAction.updateso you will need to adjust that for all cases - When the modal for custody opens, we need to have the selected user be disabled and already set to current user. We do that for booking create already.
- In the action, we need to double check the
userIdto prevent malicious actions. For self_service we need to make sure theuserIdwe are receiving from the custody form is the same as the current user's id.
I'm going to poke in here with my 2 cents. :) I think the permission to remove an asset from self custody should need to be explicitly allowed, or part of a role.
Hey @Joedon3 . The way we have designed it currently is that its part of the self service permissions. Base role has everything that self service has without being able to well, self service. So they wont be able to checkout bookings themselves and assign custody.
For the future we are planning to have a feature to allow users to fully create and manage permissions of user types. We even have a v1 design already.