"Not Authorized" page is shown for any inability to save workflow action form

[laritakr]

Descriptive summary

UI design on this issue is needed.

The workflow action form has several validations:

https://github.com/projecthydra-labs/hyrax/blob/master/app/forms/hyrax/forms/workflow_action_form.rb#L37-L48

The controller routes any inability to update the form to an "unauthorized" page, regardless of the reason. This is not intuitive behavior for an error where the action name is not present.

https://github.com/projecthydra-labs/hyrax/blob/master/app/controllers/hyrax/workflow_actions_controller.rb#L16

Rationale

It is functional but not intuitive to show a "not authorized" error page for situations that are not due to lack of permission.

Expected behavior

The desired behavior in the UI needs to be determined.

Actual behavior

The "unauthorized" page is displayed.

Steps to reproduce the behavior

This requires at least two separate users:

1. Admin user create admin set, change the workflow of the default admin set to be one-step mediated deposit, and add a depositor role to another user to the admin set.
2. Add that same user as depositor to this admin set/workflow on workflows menu.
3. Sign on as depositor user and deposit a work. Make sure the default admin set is selected in the relationships tab of the 'add new work' view. Sign off.
4. Sign on as admin (or other reviewer) user. Reviewer should get a notification that a work is waiting for review
5. Click the link in the notification or from the review menu. This will take you to the work show view.
6. Expand the "review and approval" widget at the bottom of the window, and click the submit button without selecting a radio button. This takes you to the unauthorized page:

Related work

https://github.com/projecthydra-labs/hyrax/issues/671

[mjgiarlo]

See above, @samvera/hyrax-ui-ux-advisors

Advice is welcome!

[ggeisler]

In my opinion, the first step is simply to make one of the radio buttons selected by default (in general there should always be one radio button selected in a related group of buttons). I think "Comment" makes the most sense, in that it is likely to be the most innocuous choice if the user submits without noticing the radio buttons. This would prevent routing to a new error page in the first place.

(I think the actual actions might vary by workflow? Even so, maybe "Comment" is always -- or if not, should be -- an action of a workflow, and thus could reliably be the default action?)

Even better would be to make the "Comment" option selected by default and validate that the text area is not empty when "Comment" is the selected option (it could be empty for other potential choices, such as "Approve"). If the user tries to submit with "Comment"and a null text area, show a validation error. I'm not sure if Hyrax has an established pattern for showing field validations but the mockup below assumes a standard Bootstrap approach of turning the label and field border red and showing a help message (an HTML5 field validation would be even simpler, and might be fine, but I'm not sure you can do that for this scenario where we want to validate the text area only when a particular radio button is selected).

(The mockup looks different than the current panel just because I'm using the design suggested in https://github.com/samvera-labs/hyku/issues/1033.)

[ggeisler]

I recommend implementing this after https://github.com/samvera-labs/hyku/issues/1033.