goto / guardian

Guardian is a tool for extensible and universal data access with automated access workflows and security controls across data stores, analytical systems, and cloud products.

Home Page:https://goto.github.io/guardian/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

cancelling an appeal doesn't change the pending approvers status

bsushmith opened this issue · comments

Description
When an appeal gets created, based on the policy steps, approval records are also created in approvals and approvers tables.

When the appeal gets cancelled by the user, only the status of the appeal is changed and the status of the approval is still kept as pending.

To Reproduce

  • create an appeal with policy which has manual approvals involved.
  • cancel the appeal
  • check the status of the manual approval in approvals table

Expected behavior
Approvals should also marked as canceled in addition to the appeal. The below are the current status types in approvals. we need to have a canceled type to factor in user cancellations.
image

Although it's not an incorrect state for approvals that the appeal is canceled, why are approvals with status canceled explicitly needed? IMO we can already infer from the appeal status that if it is a canceled, any pending/blocked approvals shouldn't be actionable a.k.a the approvals are locked.

The approvals API returns approvals based on filters. One would not be able to exclude these un-actionable approvals from approvals API with current set of filters.

Finalized Approach -

  • add appeal_statuses to the List Approvals API primarily - #25
  • to do effort estimation if canceled as approval type need to be added. Take decision based on this effort.

@rahmatrhd