Redmine

The scope of this issue is to decrease the confusion created by the actual watchers implementation which allows you to add to an object (issue, wiki, news) a watcher who doesn't have permissions to view that object. There are multiple open issues generated by this issue, but I opted to create a new issue, clean, to discuss some proposal that I have in plan. At the end, depending on what it's implemented, we close those issues.

I made three patches:

1. 0001-Fix-typo-in-find_objects_from_params.patch
It just fix a typo in the code.

2. 0002-Do-not-propose-watchers-that-are-not-allowed-to-see-.patch
The patch changes the behaviour of method users_for_new_watcher to reject users who doesn't have the permissions to view the object. This change applies only when the search is made for one object (eg: issue), not for multiple objects (add bulk watchers).

3. 0003-Show-an-warning-message-for-watchers-who-cannot-view
Because the second patch doesn't cover all the cases and it's difficult to cover all the cases, I've added in the UI an warning next to an invalid watcher with the following warning message: "Invalid watcher: User will not receive any notifications because it does not have access to view this object.". Any feedback on the message is welcome.

What else I have in mind:
4. Limit the number of results returned by the auto complete method to a maximum 20 or 30 objects in order to avoid performance issues (we need to iterate through each object to check the visibility). Right now, when a term is used in the search, the autocomplete returns all the results found, else returns the first 100 results. It's hard to believe that an user prefer to scroll down in the list of returned watchers instead of typing a more complete search term.

5. Return an error or an warning message when a watcher is added to an object not visible.