Merge pull request #2775 from bcgov/DEP-238-super-admin-engagement-listing

DEP-238: Fix admin permission check when listing engagements

Author: NatSquared

CHANGELOG.MD

@@ -1,10 +1,17 @@
+## March 12, 2026
+
+- **Bugfix** Always let users with SUPER_ADMIN role list engagements, even if they don't have the VIEW_ENGAGEMENT permission. [🎟️ DEP-238](https://citz-gdx.atlassian.net/browse/DEP-238)
+  - Updated the API endpoint for listing engagements to check for the SUPER_ADMIN role in addition to the VIEW_ENGAGEMENT permission and direct membership in the engagement. The role bypasses all other checks.
+  - This ensures that users with the SUPER_ADMIN role can always list engagements, regardless of their specific permissions.
+
 ## March 11, 2026
 
 - Implemented Subscribe section of engagement authoring area [🎟️ DEP-227](https://citz-gdx.atlassian.net/browse/DEP-227)
   - Added new fields to the API and database to support subscribe section data
   - Populated form components in AuthoringSubscribe.tsx to allow users to input data for the subscribe section
   - Modified AuthoringContext to include subscribe section data and actions for updating it
 
+
 ## March 8, 2026
 
 - Added delete functionality to engagement section [🎟️ DEP-175](https://citz-gdx.atlassian.net/browse/DEP-175)

met-api/src/met_api/services/engagement_service.py

@@ -116,16 +116,15 @@ def _attach_banner_url(self, engagements: list):
 
     @staticmethod
     def _get_scope_options(user_roles, has_team_access):
-        if Role.VIEW_PRIVATE_ENGAGEMENTS.value in user_roles:
+        if Role.SUPER_ADMIN.value in user_roles or Role.VIEW_PRIVATE_ENGAGEMENTS.value in user_roles:
+            # Super admins should always see all engagements within the current tenant.
             # If user has VIEW_PRIVATE_ENGAGEMENTS, e.g. Administrator role, return unrestricted scope options
             return EngagementScopeOptions(restricted=False)
         if has_team_access:
             # return those engagements where user has access for edit members..
             # either they have edit_member role or check if they are a team member
-            has_edit_role = Role.EDIT_MEMBERS.value in user_roles
-            if has_edit_role:
+            if Role.EDIT_MEMBERS.value in user_roles:
                 return EngagementScopeOptions(restricted=False)
-
             # check if user
             return EngagementScopeOptions(include_assigned=True)
         if Role.VIEW_ENGAGEMENT.value in user_roles:

met-api/tests/unit/services/test_engagement.py

@@ -24,6 +24,7 @@
 
 from met_api.models import db
 from met_api.models.engagement import Engagement
+from met_api.utils.roles import Role
 from met_api.services import authorization
 from met_api.services.engagement_service import EngagementService
 from tests.utilities.factory_scenarios import TestEngagementInfo, TestJwtClaims
@@ -142,3 +143,18 @@ def test_delete_failure_production_environment(db, monkeypatch, mocker):
                 'It is either read-protected or not readable by the server.')
 
     assert expected in desc
+
+
+def test_get_scope_options_super_admin_unrestricted():
+    """Assert that super admin can list all tenant engagements."""
+    scope_options = EngagementService._get_scope_options({Role.SUPER_ADMIN.value}, has_team_access=False)
+
+    assert scope_options.restricted is False
+    assert scope_options.include_assigned is False
+
+
+def test_get_scope_options_super_admin_overrides_team_access():
+    """Assert super admin remains unrestricted even when team access filter is requested."""
+    scope_options = EngagementService._get_scope_options({Role.SUPER_ADMIN.value}, has_team_access=True)
+
+    assert scope_options.restricted is False