Description of problem: If a user has been granted "read-everything" role (the pre-populated one we ship) and visits the system notifications, s/he gets the "Delete All " link and it is functional. Version-Release number of selected component (if applicable): How reproducible: Steps to Reproduce: 1. Create a new user, "jimbob" 2. Grant jimbob the role of read-everything 3. Login with user jimbob and navigate to the notification subsystem 4. On the ensuing page, click "Delete All" and confirm. Actual results: (Some) notifications are deleted - they disappear from screen User sees Delete All link Expected results: User shouldn't even see the Delete All link in the first place. Additional info: I'm not immediately sure whether we're just deleting just those that this user can see. Or whether they just disappear from the UI but are still there for admin user. I would think that this user's notification view might/should be otherwise be the same as admin user? In any case, we should just get rid of the Delete All link and be done with it.
+1 to getting rid of the Delete All if the user doesn't have the rights to delete stuff
I would argue this is indeed the desired behaviour. Notifications showing up under http://<fqdn>/katello/notices are custom to a user and hence deletable by the user. This behavior is similar to the user being able to edit his/her preferences (even if they do not have any privileges to edit anything).
I'm fine with the explanation above. QA Closing.