Sahil Batra 4c290a49d3 user_groups: Do not allow editing system user groups from API. ...

We do not allow any user to edit the system user groups (including
renaming, deleting, adding or removing members, etc.) from the
API. These user groups will change only by the code when a new
user is added or role of a user is changed.

This is implemented by rejecting access_user_group_by_id always
except the case when it is use to get the user group for sending
email and push notifications, as we would need to send notifications
to the mentioned user group.

2021-08-19 02:54:29 -07:00

3.4 KiB

Raw Blame History

View Raw