Uploaded image for project: 'Nuxeo Platform'
  1. Nuxeo Platform
  2. NXP-30342

Allow for granted users to delete and trash content under retention or legal hold

    XMLWordPrintable

    Details

    • Type: Improvement
    • Status: Resolved
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: 10.10-HF51, 11.5, 2021.7
    • Component/s: Retention
    • Release Notes Summary:
      Only granted users can delete and trash content under retention or legal hold.
    • Upgrade notes:
      Hide

      The "Remove" permission is no longer granted to anyone (including Administrators) on documents under legal hold or retention.
      As a direct result, the permission enricher no longer returns the "Remove" permission in the listed ones.
      Third-party apps or clients can now only rely upon the presence of the "Remove" permission on the document and stop checking if the document is under legal hold or retention to prevents its deletion.
      However, if retention is not in compliance mode (i.e. nuxeo.retention.compliance.enabled=false which is the default), users belonging to the "NuxeoRecordCleaners" group will still have the "Remove" permission listed on documents under retention or legal hold if explicitly granted.

      Show
      The "Remove" permission is no longer granted to anyone (including Administrators) on documents under legal hold or retention. As a direct result, the permission enricher no longer returns the "Remove" permission in the listed ones. Third-party apps or clients can now only rely upon the presence of the "Remove" permission on the document and stop checking if the document is under legal hold or retention to prevents its deletion. However, if retention is not in compliance mode (i.e. nuxeo.retention.compliance.enabled=false which is the default), users belonging to the "NuxeoRecordCleaners" group will still have the "Remove" permission listed on documents under retention or legal hold if explicitly granted.
    • Sprint:
      nxApps 2021 Cycle 6

      Description

      User story

      As a platform administrator, I want to configure if a granted user can delete or trash a document under retention and/or legal hold.

      As a user with a specific role and ONLY in case of the retention addon is configured to allow it, I can delete a document under retention or under legal hold, so that I can delete content in case of mistake (wrong retention period) or in case of legal change with retroactive application.

       

      Description

      The goal is to maintain a high level of security by using retention features but with more flexibility (except with the Compliance mode) as power users can delete a record under retention or legal hold.

      This improvement requires to create a specific user group: NuxeoRecordCleaners

      To be enabled, this capability requires the following configuration:

      • "Compliance mode" (nuxeo.retention.compliance.enabled in nuxeo.conf) must NOT be enabled (e.g nuxeo.retention.compliance.enabled CANNOT = true)
      • the specific group NuxeoRecordCleaners is created from the admin menu

      Acceptance criteria

      When the retention addon is NOT configured in Compliance mode:

      • As a user with ManageRecord permission, I CANNOT delete a document under retention or legal hold
      • As a user with Remove permission but not belonging to the NuxeoRecordCleaners group, I CANNOT delete a document under retention or legal hold
      • As a user with Remove permission and belonging to the NuxeoRecordCleaners group, I can delete a document under retention or legal hold 
      • As an administrator, I CANNOT delete a document under retention or legal hold

       

      • As a user with ManageRecord permission, I CANNOT trash a document under retention or legal hold
      • As a user with Remove permission but not belonging to the NuxeoRecordCleaners group, I CANNOT trash a document under retention or legal hold
      • As a user with Remove permission and belonging to the NuxeoRecordCleaners group, I can trash a document under retention or legal hold 
      • As an administrator, I CANNOT trash a document under retention or legal hold

       

      When the retention addon is configured in Compliance mode (nuxeo.retention.compliance.enabled=true):

      • As a user with ManageRecord permission, I CANNOT delete a document under retention or legal hold
      • As a user with Remove permission but not belonging to the NuxeoRecordCleaners group, I CANNOT delete a document under retention or legal hold
      • As a user with Remove permission and belonging to the NuxeoRecordCleaners group, I CANNOT delete a document under retention or legal hold
      • As an administrator, I CANNOT delete a document under retention or legal hold

       

      • As a user with ManageRecord permission, I CANNOT trash a document under retention or legal hold
      • As a user with Remove permission but not belonging to the NuxeoRecordCleaners group, I CANNOT trash a document under retention or legal hold
      • As a user with Remove permission and belonging to the NuxeoRecordCleaners group, I CANNOT trash a document under retention or legal hold
      • As an administrator, I CANNOT trash a document under retention or legal hold

        Attachments

        1. Screen Shot 2021-05-21 at 07.22.01.png
          92 kB
          Andrea Cornaglia
        2. Screen Shot 2021-05-21 at 07.23.21.png
          1.15 MB
          Andrea Cornaglia
        3. Screen Shot 2021-05-21 at 07.25.01.png
          213 kB
          Andrea Cornaglia
        4. Screen Shot 2021-05-21 at 07.29.02.png
          1.58 MB
          Andrea Cornaglia
        5. Screen Shot 2021-05-21 at 07.29.33.png
          839 kB
          Andrea Cornaglia

          Issue Links

            Activity

              People

              • Votes:
                0 Vote for this issue
                Watchers:
                4 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: