US: Audit a member’s permissions

[gviedma-aulasneo]

As a Library Admin, I want to view a member's roles and permissions for this library, so that I can audit access.

Figma: https://www.figma.com/design/q3Knq0BKoVTBbtaxb81n9R/RBAC---Console---Wireframes?node-id=2750-12293&t=71PeX22gyABqxnHu-4
https://www.figma.com/design/q3Knq0BKoVTBbtaxb81n9R/RBAC---Console---Wireframes?node-id=2750-13331&t=71PeX22gyABqxnHu-4

Acceptance criteria

• Placement
  From the Team Members tab, the Edit control opens the User View within Library Team Management.

• Access
  Visible only for users with the manage team permission.

• Header context
  Shows the user's name and email

• Content
  The Roles section shows all roles the user holds in this library, as Role Cards.
  Use the shared Role Card component. Each card includes the role's scope (Library name), a short role description, and a list of that role's permissions grouped by category.
  Permissions section lists only granted permissions, grouped by category, Library, Content, Team, Collections.
  Each permission category has a tooltip with a short description. Descriptions are WIP.

• States
  Loading uses skeleton rows or blocks.
  Error shows a message with a Retry action.

Notes, out of scope for this card

• API and error views are defined in a separate card. 401 and 403 use the same auth error view. 404 and general server errors use a not found or generic error view with a Retry.

Test Cases

Setup

• Admin A has the manage team permission for the target library.
• Member X belongs to the library and has at least two roles with distinct permission sets.
• The permission categories exist, Library, Content, Team, Collections.
• Start on Libraries → Library Team Management → Team Members.

Scenarios

• 1) Placement, Edit opens User View
  Given: I am logged in as Admin A on the Team Members tab
  When: I click the Edit control on Member X
  Then: I am taken to User View within Library Team Management

• 2) Access control, only users with manage team can view
  Given: I am logged in as a user without the manage team permission
  When: I try to open User View for any member of this library
  Then: I cannot see the User View control for any user

• 3) Header context and Role Cards overview
  Given: I am on User View for Member X
  When: the page renders
  Then: I see Member X name and email in the header
  And: I see a Roles section with one Role Card per assigned role

• 4) Roles section shows one Role Card per role
  Given: I am on User View for Member X
  When: I view the Roles section
  Then: I see one Role Card per role assigned to Member X
  And: when I count the Role Cards
  Then: the count equals the number of roles that Member X holds in this library

• 5) Each Role Card shows scope, description, permissions grouped by category
  Given: I am on User View for Member X
  When: I inspect any Role Card
  Then: I see the role name, the role scope showing the library name, and a short description
  And: when I review the permissions on that card
  Then: they are grouped by category, Library, Content, Team, Collections

• 6) Role Card permissions match the catalog for that role
  Given: the roles catalog is defined here, https://openedx.atlassian.net/wiki/spaces/OEPM/pages/4840095745/Library+Roles+and+Permissions
  When: I compare a Role Card permissions list to the catalog for that role
  Then: the listed permissions match the catalog for that role, grouped by the same categories

• 7) Category tooltips appear on hover and disappear when I move the cursor away
  Given: I am viewing a Role Card
  When: I hover a permission category label
  Then: I see a tooltip with a short description
  And: when I move the cursor away
  Then: the tooltip disappears

• 8) Loading state shows skeletons, then content appears
  Given: I am navigating to User View for Member X
  When: data is still loading
  Then: I see skeleton rows or blocks in place of the Roles content
  And: when loading completes
  Then: the skeletons are replaced by the Role Cards

[dcoa]

@gviedma-aulasneo I just want to double check the view header (page title) context you say should display the library name and id besides the user information. However the figma does only shows the user information.

[gviedma-aulasneo]

@dcoa, that is true, my bad. The library name only appears in the role card. Let me correct the issue.

[MaferMazu]

My comment here is: Is it not redundant if a user has more than one role?

Because following Libraries Roles and Permissions, a Library Admin has all the permissions of a Library Author, and the Author all the permissions of a Collaborator, and the Collaborator all the Library User permissions.

Checking the #47 we have: "If a user exists and is already in the team without that role, add the role.", which also suggests that the person can have more than one role for a library. I'm not sure that makes sense.

What do you think @gviedma-aulasneo?

[gviedma-aulasneo]

@MaferMazu a user can hold more than one role within a scope, roles are stackable. The design supports future scalability as roles become more complex.

For libraries, the next RBAC step is multi library administration. A user may be Library Author across all libraries, and Library Admin in just one. We need to represent and audit that.

[dcoa]

Evidence

2025-10-13.21-08-38.mp4

@gviedma-aulasneo @jmakowski1123

Guillermo could you please help me to verify and confirm that the descriptions for the tooltips are correct, or if there is a text that should be modified from what is actually in the design.

[gviedma-aulasneo]

@dcoa Great job! Quick question: you said in the video that Roles and Permissions are already connected to the backend. For example, Admin should have all the permissions available in the list. Is that a bug, or is the backend still being developed and, once finished, the list will match the definition?

[dcoa]

@when I recorded the video I have a old backend, that is why is not displaying, but yes with the right backend the permissions will match the definition