[PoC][QT-Portal][WRU] - Download of medical data - Error 403, request failed in Benutzerverwaltung when trying to change test-center for a user after cancellation date

[kerstin-oppermann-tsi]

Environment : WRU

https://dfe4f5c711db.schnelltestportal.de/qt/

Preconditions:

Partner contract for partner test1021 or test1025 has already been cancelled (e.g. cancellation date on 26.10.22 or 10.11.22), Test-Centers and addition of new users have already been deactivated as expected in "Benutzerverwaltung".

Test Steps :

The admin user logs in to the QT portal.
The user clicks on the button "Benutzerverwaltung".
The test-centers and users for the partner are listed (options for test-centers are deactivated, new users cannot be added, but existing (non-admin) users can still be edited.
The user tries to change the test-center for an existing (non-admin) user.
Expected Results:

When the user tries to change the test-center for a user, this should not be changed.
No error message occurs
Actual Result:

The test-center is not changed for the user as expected. An error message "request failed with status code 403" is shown - see Screenshots

The test-center is not changed for the user.

[ascheibal]

technically it works as expected: backend refuses any changes in group administration. This issue cannot put the system in incorrect state though.
The user administration is still possible after cancellation date to give the admins even then the ability to delete users on their request.
Their two ways to address this:

1. give the user an more convenient response to handle this error
2. restrict user management and disable user editing in DOWNLOAD_REQUESTED cancellation state, only leaving the option to delete the user.