Openfoodnetwork: Displaying customers' names to hub's suppliers

[RachL]

Description

All history is here: https://community.openfoodnetwork.org/t/1-hubs-suppliers-can-prepare-the-invidual-orders-for-the-hubs-customers/1151/48

In a nutshell, we want to give hubs the possibility to un-hide their customers names and firstnames for their suppliers in all their reports. Currently those are hidden for their suppliers, and this should remain the default case.

We will close this epic once all the issues linked to it are closed. Follow-up on this will be done in discourse.

List of issues:

1. As a hub, I can give my suppliers access to my customers' name and firstname https://github.com/openfoodfoundation/openfoodnetwork/issues/5054
2. As a producer, I can see a hub's customers firstname and name https://github.com/openfoodfoundation/openfoodnetwork/issues/5097
3. Create a Matomo event for the new shop preference radio button https://github.com/openfoodfoundation/openfoodnetwork/issues/5055

[RachL]

@sauloperez apart from the sentence, the epic is ready for review!

[sauloperez]

done

[Matt-Yorkley]

In terms of permissions, do we want to add this as a new item in the permissions UI? That way a distributor could selectively grant this permission to some suppliers and not others...

[RachL]

@Matt-Yorkley we went for an enterprise settings see mockups here:

https://github.com/openfoodfoundation/openfoodnetwork/issues/5054

We discussed this during inception but chose not to go towards detailed permissions yet as we are only focusing on names. https://community.openfoodnetwork.org/t/1-hubs-suppliers-can-prepare-the-invidual-orders-for-the-hubs-customers/1151/49?u=rachel

[Matt-Yorkley]

Suppliers/Producers can't actually view Xero Invoice reports for a distributor's orders (unless the user also manages that distributor), and they don't contain customer names anyway...

[Matt-Yorkley]

Customers report is not viewable by suppliers either, it only returns data to users that manage the distributor enterprise (who can see customer names already). Same with all Order Cycle Management reports and Sales Tax reports.

[RachL]

@Matt-Yorkley we did a list of all reports in the issue here: https://github.com/openfoodfoundation/openfoodnetwork/issues/5054

[Matt-Yorkley]

So I think the list of reports we actually need to implement this for is only:

• Orders and distributors (one column: Customer name)
• Bulk Co-op (one column: Customer name)
• Orders and Fulfillment - Order Cycle Customer Totals (one column: Customer name)
• All Customers (name and first names are two columns on these ones!)
• Enterprise Fee
• All Order Cycle Management (name and first names are two columns on this one!)
• All Sale Tax
• Xero invoices
• All packing reports (name and first names are two columns on these ones!)

[RachL]

@Matt-Yorkley I'm not sure I agree. When I login as a supplier I do have access to all these reports.

Maybe you tested as a producer that does not sell? In any case we must cover both type of producers. But you are right this is missing from the tests cases. I will add them.

[Matt-Yorkley]

As an example: if you log in as a user that only manages a supplier can you see any data in Customer reports for customers of a distributor that the logged in user does not manage?

[RachL]

@Matt-Yorkley aaah yes ok I understand now. Indeed, the supplier can access the report, bu cannot see _data_ from the distributor :+1:

[Matt-Yorkley]

Yep. The Customers report only returns data for distributors the user manages. The same logic applies to the other reports I crossed off the list :+1:

[Matt-Yorkley]

I think if we make any mistakes while touching this code, we could easily create some serious data privacy issues. We need to be really careful and precise with this... :sweat_smile:

[sauloperez]

5769 got merged so this will be shipped to production next Tuesday! :tada:

[RachL]

As discussed in delivery train, I've moved #5055 to an epic dedicated to analytics. Thus closing here :)