Benevolence Type Security not honored

[bobrufenacht]

Description

(on behalf of North Point Ministries) If you create two Benevolence Types and secure them to separate security roles, all people can see and create both types. The security on the types is not honored. This is on both the current 16.6 blocks and the prealpha obsidian blocks.

Actual Behavior

The security setting on the types has no affect on any blocks or dropdowns. Everything is still visible to anyone with page level access.

Expected Behavior

I would expect the type level security to only show items a person has rights to in the List block. I would also expect the selection of a type (dropdown) when creating new items to show the ones a person has rights to. While it would be nice if the Result Types were also segmented by Benevolence Type, I think that would be considered an enhancement and not a bug.

Steps to Reproduce

1. Go to Finance -> Benevolence
2. Click the Gear icon and add a second type.
3. Set security on the new type to a different Security Role (not Benevolence - I used Prayer Admin)
4. Grant Prayer Admin rights to the /finance/benevolence page
5. Add Prayer Admin and Staff Like Worker to a person (I used Ben Jones)
6. As Ben Jones navigate to the /finance/benevolence page
7. Ben Jones can see the Benevolence Requests even though he only has rights to the second type.

Issue Confirmation

• Perform a search on the Github Issues to see if your bug or enhancement is already reported.
• Reproduced the problem on a fresh install or on the demo site.

Rock Version

16.6 but also duplicated with Obsidian blocks on prealpha.

Client Culture Setting

sn-US