five-c: BUG: Form validation prevents editing of fields user has permission for

[rogu-beta]

Describe the bug
The general issue is that forms only allow users to update data if they have permission to all fields. Partial updates are not possible. For instance, if a user has the engineer role and staff status, they can attempt to manage the packages of a product. However, while the UI permits them to edit concluded licenses, they will be unable to save changes, because they do not have permission to edit the review status. These fields are disabled in the form, but on submission it will not do a partial update, it will block the edit entirely.

A related issue happens when editing packages, though there it seems that even granting the required roles is not working. Despite having the following roles and staff status, a user is still unable to set the usage policy of the package:

• Data administrator
• Engineering
• Legal
• Reporting administrator
• Usage policies
• Workflow administration

It seems only super users are able to perform this edit. As before updating other fields is also not possible, due to the disabled usage policy drop down.

To Reproduce
Steps to reproduce the behavior:

1. Create a user and assign them staff status and the engineer role
2. Attempt to edit the package inventory and save changes

Steps to reproduce the behavior:

1. Create a user and assign them staff status and the roles outlined above, in particular engineering, data administrator, and usage policy
2. Attempt to edit a package and save changes

Expected behavior
In the first case I would expect a partial update to happen, meaning that the disabled fields/input box/drop downs are being excluded and only those that the user may edit are being considered in the validation and submission.

In the second case I'm guessing something in the permission assignment is wrong, because those roles should cover the assignment of the usage policy based on my understanding of the permission matrix.

Screenshots
See above.

Context (OS, Browser, Device, etc.):

• DejaCode 5.6.0
• Firefox

[DennisClark]

@rogu-beta thanks for your detailed analysis of a complicated issue. We shall investigate a solution.

[DennisClark]

@tdruez This problem was also brought up in five-c project communications, and is critical for that project I think. Please see what can be done to address the non-superuser permissions for this DejaCode form. Here was the reported problem:

> I tried to edit the vulnerability analysis of VCID-c94m-sbts-aaae / pkg:pypi/django@5.0.6. That gave an error. The "Status", "Justification" and "Responses" are all empty and cannot be edited?