2907 Prevent deletion of submitted projects

[arshiamasih]

• Fixes Dev: Prevent the Deletion of Submitted Projects #2907

What changes did you make?

• Only show the Delete action icon in the project context menu and and project wizard on explicit conditions:

Pop Over | DELETE
draft, owned by me
snapshot, (not submitted) owned by me

Pop Over | No DELETE
draft, not owned by me
snapshot, not owned by me
submitted snapshot, owned by anyone

• Updated the wizard popup content style to match the design system + project context popup

Why did you make the changes (we will use this info to test)?

• We need to prevent the accidental deletion of submitted projects from the Context Menus on the My Project Page and the Project Summary Page (Page 5) of the Calculation Wizard

Screenshots of Proposed Changes Of The Website (if any, please do not screen shot code changes)

Visuals before changes are applied

• All cases showed the delete action in the menus, see changes below

Visuals after changes are applied

Case SHOW DELETE: draft, owned by me

Project context menu:

Project wizard:

Case SHOW DELETE: snapshot, (not submitted) owned by me

Project context menu:

Project wizard:

Case DO NOT SHOW DELETE: draft, not owned by me

Project context menu:

Project wizard:

Case DO NOT SHOW DELETE: snapshot, not owned by me

Project context menu:

Project wizard:

Case DO NOT SHOW DELETE: submitted snapshot, owned by anyone

Project context menu:

Project wizard:

[entrotech]

The part that is missing is the change to the web api server that rejects a PUT request to delete a project if it has been submitted. In my mind this is the most important part, because

1. It does not depend on the more complex front-end logic being perfect to prevent accidental deletion of submitted projects, and
2. it prevents an attacker from maliciously bypassing the front-end code to delete projects (admittedly a pretty unlikely attack strategy)

Also, see my comments below.

[arshiamasih]

The part that is missing is the change to the web api server that rejects a PUT request to delete a project if it has been submitted.

Yes agree and makes perfect sense - missed the Action Items section on this issue -- will add this 🙏🏽