Custom subobject list in MUX will show + to users without a Create right

Products

• Clarity PPM SaaS
• Clarity PPM On Premise

Issue/Introduction

Custom subobject list + button behaves inconsistently with other subobjects by allowing the user to see and click on the + button only to discover they do not have permissions

 

STEPS TO REPRODUCE

1. With admin user go to Administration - Objects - create a new custom object Test subobject to Project, enabled for API
2. Add all the Test subobject permissions to admin user
3. Go to MUX and add the Test subobject module to the Project blueprint
4. Create few instances on a selected project
5. Create a user in Clarity and assign Project Manager rights, also Test - View All global right
6. Now connect with this new user and open the same project you've worked on above
7. Navigate to module Test

 

Expected Results:

The + button not to be present as the user does not have Create rights for the subobject, just the master object

Actual Results: The + button is available in the Test object list, when the user clicks on it and tries to enter a new instance, an error is thrown: API-1007: You are not authorized to process request. Contact your system administrator for necessary security rights

The same is not the case on master objects or Tasks or RIC modules.

 

Environment

Release : 16.0.1, 16.0.2

Resolution

This is DE66023, reviewed by Engineering and this change needs an enhancement to be applied. This will be addressed as a part of a future user story.