[OP-19734] Fix deletion of work packages with children, by looking at who we can delete and see - #24473
Merged
oliverguenther merged 3 commits intoJul 29, 2026
Conversation
oliverguenther
force-pushed
the
fix/deletion-of-work-packages-with-children
branch
2 times, most recently
from
July 28, 2026 14:06
84d4ce1 to
f2e73af
Compare
oliverguenther
marked this pull request as ready for review
July 28, 2026 14:10
oliverguenther
force-pushed
the
fix/deletion-of-work-packages-with-children
branch
6 times, most recently
from
July 29, 2026 08:35
db430db to
ec9ecf2
Compare
… who we can delete and see Both delete dialogs built their descendant list with a plain WorkPackage query and no proper permission check. Selecting a work package with a child in a project you have no access to resulted in a visibility violation. The dialogs now filters descendants with WorkPackage.visible, categorize them into ones that they can see, but not delete, or not see. A warning banner says how many descendants you cannot see (or delete), without naming them or their projects. As discussed with product, we want to unlink descendants rather than preventing deletion of the parent. For that,DeleteService now iterates all descendants. The ones without permission keep their own hierarchy, but get the parent unlinked depending on: - with manage_subtasks in the parent's project they are detached (parent: nil) and carry a new Journal::CausedByWorkPackageParentDeletion, rendering as "Parent removed because the parent work package was deleted" - without it the call fails with :cannot_detach_undeletable_descendants and nothing is deleted Adds substantial test coverage for invisible descendants in children, grandchildren in other projects, etc. https://community.openproject.org/work_packages/OP-19734
oliverguenther
force-pushed
the
fix/deletion-of-work-packages-with-children
branch
from
July 29, 2026 08:36
ec9ecf2 to
4a0c2ac
Compare
mrmir
approved these changes
Jul 29, 2026
mrmir
left a comment
mrmir
left a comment
Contributor
There was a problem hiding this comment.
Nice! I think I got to all the test cases locally as well 🤞🏽
Co-authored-by: Mir Bhatia <m.bhatia@openproject.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Both delete dialogs built their descendant list with a plain WorkPackage query and no proper permission check.
Selecting a work package with a child in a project you have no access to resulted in a visibility violation.
The dialogs now filter descendants with WorkPackage.visible and count the rest.
A warning banner says how many descendants you cannot see, without naming them or their projects.
The bulk dialog now renders the multi-project warning as an info banner instead.
As discussed with product, we want to unlink descendants rather than preventing deletion of the parent.
For that,DeleteService now iterates all descendants. The ones without permission keep their own hierarchy, but get the parent unlinked depending on:
Adds substantial test coverage for invisible descendants in children, grandchildren in other projects, etc.
Adds a cause for deleted parents
https://community.openproject.org/work_packages/OP-19734
Case 1 - no children
Case 2: children that I can delete
Case 3(a) One invisible
Case 3(b) Multiple invisible
Case 4(a) can't delete one, can't view one, CAN delete one
Case 5 - Bulk delete, can't see some descendants
Case 5(a) - Bulk delete, with some visible descendants to be deleted
Case 5(b) - Delete with some children viewable, not deletable
Project names linked