Feature request: Preventing deletion of obsolete test sessions by organisation users

[RikkeVestesen]

Hi

We have a feature request to allow administrators to decide whether users are permitted to delete test sessions.

[costas80]

Hey @RikkeVestesen. In fact this is already the case (just double-checked the permissions). The only users that can delete test sessions are the Test Bed administrator and Community administrator - organisation users can never delete test sessions.

The only exception here is the possibility to delete obsolete test sessions which is possible for organisation admins. Obsolete test sessions are those that do not apply at all anymore because related data has been deleted (e.g. the related test cases have been deleted). The only scenario where an organisation user's action could lead to test sessions becoming obsolete and delete-able is if an organisation admin deletes the related system (all other cases would result from a community admin's action - e.g. new test suite with history reset, deleting a specification etc.).

From my point of view keeping the option to delete obsolete test sessions is OK. If a system is deleted then the overall conformance statements are also deleted (i.e., users can't selectively delete sessions to affect their conformance or your review process).

Can you confirm that things are OK to keep as they are?

[RikkeVestesen]

Hi @costas80

Thank you for investigating.

For us, completed test sessions are evidence and must not be deleted or become inaccessible.

Therefore, organisation administrators must not be able to delete test sessions, systems or organisations.
This should also apply to obsolete test sessions. If a test case is removed or disabled because it is no longer relevant, the previous sessions must remain available as evidence that the system was tested against that test case.

One possible approach could be to archive or deactivate systems and organisations that are no longer active, while keeping all historical test sessions and uploaded evidence accessible. Permanent deletion should then only be available to Test Bed administrators.

Could you confirm whether deleting a system or organisation currently also deletes or hides its test sessions?

What is your thoughts on this? :)

[costas80]

Could you confirm whether deleting a system or organisation currently also deletes or hides its test sessions?

Actually I again spoke too soon. You already have a community permission that can prevent organisation administrators from creating or deleting systems (and conformance statements for that matter):

So basically if you disable these permissions, your users will not be able to make such deletions (i.e. you would create and/or delete systems on behalf of your users which matches what you already do). The point on the conformance statements is secondary whereby you can choose to create your users' statements on their behalf or let them do so themselves. In any case, conformance statements are lightweight concepts meaning that you can delete and recreate them freely without any data loss (they will just reinitialise based on the latest test sessions if recreated after being deleted).

So basically, considering that you can block systems' deletion by organisation users there is nothing that organisation users can do to ever make test sessions obsolete and thus delete-able. In other words only you - the community admin - can render tests obsolete by e.g. deleting a specification or updating a test suite while forcing a re-test.

Could you confirm whether deleting a system or organisation currently also deletes or hides its test sessions?

As mentioned above, only you can delete a system and/or an organisation. If you do so test sessions don't get deleted but are rather flagged as obsolete. It is interesting however to note that currently, if you do such a change rendering test sessions obsolete, an organisation admin can still choose to delete their own obsolete test sessions.

What is your thoughts on this? :)

So I think to fully 100% control this and never allow an organisation to delete in any circumstances an obsolete session, we could foresee an extra community permission "Delete obsolete test sessions" (by default true - matching the current behaviour). In your case you can set this to false and thus prevent any and all deletions.

If you confirm I'll add this as a feature request to our backlog. It's quite simple to put in place so we could roll it out super fast - maybe even today if you confirm fast enough :).

[RikkeVestesen]

The additional community permission, “Delete obsolete test sessions,” is a good idea.

Could the permission to create and delete systems also be split into two separate permissions? We would like users to create their own systems without allowing them to delete systems and the associated test sessions :)

[costas80]

The additional community permission, “Delete obsolete test sessions,” is a good idea.

Added to the backlog!

Could the permission to create and delete systems also be split into two separate permissions? We would like users to create their own systems without allowing them to delete systems and the associated test sessions :)

Actually I think you already have everything you need regarding systems. At community level there is a specific permission Update system data after testing which prevents deletion and even updates to occur if a system has recorded test sessions.

The previously mentioned permission Create or delete systems is meant to prevent any system management (even as part of the initial setup) by organisation admins.

Considering this I think that in your case you should, permission-wise:

• Keep Create or delete systems as enabled. This allows organisation admins to freely create, edit and delete their own systems, as part of their setup (before tests are made).
• Set Update system data after testing to false. This ensures that systems can't be deleted once test sessions have been recorded (i.e. exactly the case you mentioned).
• Set Delete obsolete test sessions to false. This is the new permission we are talking about. With this in place, organisation users will not even be able to delete obsolete sessions (made obsolete because of a Test Bed or Community admin action - never by actions of an organisation user).

I think this configuration would cover you nicely no?

[RikkeVestesen]

Yes, it’s great that “Update system data after testing” resolves the issue. This solution is perfect for us—thank you for your help!

[costas80]

The discussed update is now available on the latest nightly build.

The community permissions now include the new Delete obsolete test sessions permission (by default enabled). By disabling this you prevent organisations users from deleting obsolete tests.

@RikkeVestesen let me know once you've confirmed on your end so that we close this issue. Thanks!