Trash-Tab in Courses, Groups and Folders

1 Initial Problem

Currently the Trash is available on to Administrators. Users with "Delete" permission cannot restore objects from their courses, groups, folders. 

2 Conceptual Summary

• A user with "Delete" permission for an object comprised in the course, group or folder has actually deleted an object from a course, group or folder, they are presented with an additional tab "Trash". 
• The deleted objects of the course are presented in the tab "Trash". 
• User cannot delete objects from the tab "Trash", this remains the prerogative for people with access to the trash in the administration.
• If user has the "Create" permission for the deleted object type in the course, group or folder, user can user with They can restore the object in the same location by themselves. 

3 User Interface Modifications

3.1 List of Affected Views

• New Tab Trash in courses, groups and folders 

3.2 User Interface Details

3.3 New User Interface Concepts

No new concepts.

3.4 Accessibility Implications

No accessibility implications.

4 Technical Information

Killing, Alexander [alex], 10 May 2024: As far as I know, I cannot check permissions on objects in the trash. So I cannot check, if someone has the "Delete" permission for anything in the trash. I could only check if the user has "creation" permission for any object type of objects in the trash.

5 Privacy

If objects hold personal data, the user may gain access to this data, by recovering the objects.

6 Security

No security issues.

7 Contact

• Author of the Request: {Please add your name.}
• Maintainer: Killing, Alexander [alex] (Repository), Kergomard, Stephan [skergomard] (Access Control)
• Implementation of the feature is done by: {The maintainer must add the name of the implementing developer.}

8 Funding

If you are interest in funding this feature, please add your name and institution to this list.

• …

9 Discussion

Kunkel, Matthias [mkunkel], 21 MAY 2024: It is unclear in this proposal which 'Delete' permission is mentioned in chap 2. Is it the 'Delete' permission for the deleted object (that cannot be checked according to Killing, Alexander [alex]? Or is it the 'Delete' permission for the container from which the object has been deleted? Both cases have implications: Case 1 might present a 'Trash' tab also to users who are course members but have Delete permissions on a single object. Case 2 would violate a basic concept of the RBAC that object permissions are always respected and not substituted by container permissions, e.g. when copying courses. I have the strong feeling that this FR needs a feature workshop first before being discussed at the Jour Fixe.

Tödt, Alexandra [atoedt] 05.05.2024: I clarified the FR. Case 1: If a course member has delete permission for an object they will see the tab Trash, if they additionally have the create permission for an object type comprised in the trash, they can restore in same location. 

JourFixe, ILIAS [jourfixe], 10 JUN 2024: We still see problems related to the current suggestion and prefer to have a distinct feature workshop before finally deciding about this feature request. Decision postponed.

10 Implementation

{ The maintainer has to give a description of the final implementation and add screenshots if possible. }

Test Cases

Test cases completed at {date} by {user}

• {Test case number linked to Testrail} : {test case title}

Privacy

Information in privacy.md of component: updated on {date} by {user} | no change required

Approval

Approved at {date} by {user}.