ref: PP016

User story

Is your feature request related to a problem? Please describe.

As an administrator of Decidim, I'm worried that users who have to promote an Initiative can access the admin panel (although limited to only their initiatives). I'm worried about security and usability reasons:

• Security:
  • our backend forms are not that well sanitized as our frontend forms
  • if there's an issue with our Authorization strategy a user could potentially access to all the administrator
• Usability: as a user is weird to have access to the administrator panel

Describe the solution you'd like
To migrate these forms from the backend admin panel to the frontend.

The actions that need to be available on frontend are:

• View Initiatives
• Edit Initiative
• Accept promotor committee members
• Print form application
• Manage Attachments
• Send to Technical Validation

For contractual and time constraints we're not handling some actions, so it'd still be accessible the admin panel backend, but the logic will change, as the participant would access the backend once an admin has technically validated her initiative. The actions we will not support for the moment are:

• Manage Meetings
• Manage Pages

Describe alternatives you've considered
It's difficult especially for usability reasons, as this couldn't be solved in other ways.

The lists of the initiatives that I've created should be listed on the "My initiatives" filter on the Initiatives list.

If we didn't have the time constraints, it'd be awesome to have all the actions so no participant can access the admin panel.

Additional context

🎨 Frontend

Last step of Initiative creation wizard

This is the last step of the wizard to create an initiative. We have to modify the text that until now said that the author must access the administration panel to manage it. In this mockup there are the texts to be displayed from now on

Initiative edit form

If the author clicks on "Edit my initiative" the editing form of the initiative is displayed with all the actions integrated in it, except the button "Send to technical validation". You can see that we have included the management of the attachments, the promotion committee and the action of printing.

If the initiative doesn't require a promotion committee or does not require attachments, they will not be shown on the form (these options are configurable settings according to the type of initiative).

Initiative page created pending technical validation

This is the page with the actions to be taken when an initiative is not published.

Initiative page published

Once the initiative is published, there is no point in showing the action buttons because the author can no longer modify it. That's when the signature counter and comments are displayed.

Does this issue could impact on users private data?
No

Acceptance criteria

• As an admin I can manage from the admin panel any initiative as before
• As a promoter of an Initiative I see an updated explanation of the steps to follow in the last step of the initiative creation wizard
• As a promoter of an Initiative I can see all my Initiatives through the filter "My initiatives", regardless of the status they're in
• As a promoter of an Initiative I don't have access to admin panel
• As a promoter of an Initiative I can edit the Initiative on the frontend
• As a promoter of an Initiative I can manage (Create, Read, Update, Delete) attachments if applicable, through the edition form
• As a promoter of an Initiative I can manage members of the promotor committee if applicable, through the edition form
• As a promoter of an Initiative I can print the form application
• As a promoter of an Initiative I can send to technical validation
• As a promoter of an Initiative when I send to technical validation I see a modal confirmation of "Are you sure?"
• As a visitor I only see open and closed initiatives