Local system admins can deactivate & reactive 'Performance Manager' and 'National Registrar' users in the same jurisdiction (office)

[tharakadadigama20]

Bug description:

User deactivation/ reactivation issue related to the local system admin.
Note: This bug might be a continuation of this bug

Prerequisites:

User should be logged into the system as local system administrator

Steps to reproduce:

1. Navigate to the 'Team' menu
2. Click on vertical dots from 'Performance Manager' and 'National Registrar' user roles
3. Verify the ability to Deactivate/ Reactivate

Actual result:
Local admin able to deactivate/ reactivate 'Performance Manager' and 'National Registrar' user roles

Expected result:
Local admin should not be able to deactivate/ reactivate 'Performance Manager' and 'National Registrar' user roles.
Therefore, better to remove/ hide 'Deactivate'/ 'Reactivate' options from 'Performance Manager' and 'National Registrar' user roles, or disable from API level.

Screenshot/Recording:

WhatsApp.Video.2025-07-04.at.12.53.09.mp4

OpenCRVS Core Version:

• v1.8.0

[euanmillar]

@SyedaAfrida this issue isnt reproducible in our country configuration for 1.8.1 right? I think that this is a config problem. Can you confirm please?

[SyedaAfrida]

@euanmillar Currently Local system admin cannot create any Performance manager/ National registrar. Thus they cannot deactivate or reactivate them. But there is a way round. If a National registrar puts local system admin in the same office as Performance manager/ National registrar, then local system admin is able to deactivate or reactivate them. So we can say this is a configuration problem as we don't expect them to be in the same office

[euanmillar]

@SyedaAfrida I think this is a legitimate bug. The configuration is only applied to the create / edit user forms but not to the user list containing the deactivate/reactivate buttons. IET team have classified this as a medium priority issue for resolution in 1.9. Alternatively @tharakadadigama20 may decide to resolve this in a 1.8.2 hotfix if he requires the fix sooner than 17th October. Do you have any thoughts on this @Zangetsu101 ?

[Zangetsu101]

@euanmillar The 3 dot menu shows up next to a user only if you have the scope to edit them. So Syeda is right about this one

[jpye-finch]

Is this not the fix?
https://opencrvsworkspace.slack.com/archives/C08RF8SH8S2/p1746793121888769
#9523

using scopes you define what user roles types the "admin" user can update

[euanmillar]

@Zangetsu101 but in the linked discussion, Tonga have not configured the users that a local system admin is able to activate/deactivate that they seem able to do in this video

[Zangetsu101]

Apologies, @euanmillar you are absolutely right. We are not yet considering the newer create/update scopes in this function: https://github.com/opencrvs/opencrvs-core/blob/v1.8.0/packages/client/src/hooks/useAuthorization.ts#L128-L150. Updating that should do the trick. Thanks for prompting me to take a look at the actual implementation of the function 😅. I had just thought we did initially

@jpye-finch Yeah the one you mentioned is the fix, just that we weren't respecting those scopes in the implementation of the function that I mentioned above

[jpye-finch]

@Zangetsu101 ah so it was a configuration bug?

[Zangetsu101]

Nope it's actually a bug in core