Org Web Adapter

Editing pages/visibility_settings_for_people_attributes.org

:PROPERTIES:
:ID:       3ef45620-6ed8-4b39-9062-16922d35351f
:END:
#+title: Visibility Settings for People Attributes

- source :: https://15five.quip.com/H0nSARhwqUsE
- epic :: https://15five-dev.atlassian.net/browse/ENG-11315
- tags :: [[id:ca1d297e-764f-4c7d-90c7-93f448fee10b][People Attributes]] [[id:e273e0ee-4ce6-4cb3-b967-51d378ede2da][Project]] [[id:b08ac197-337b-4392-84d5-98eaead61400][15Five]]

* Draft stories
** Allow visibility setting of custom People Attributes via the internal and API
Default all custom people attributes to be visible to Company Admins only.

The visibility is set on a per-attribute level, but affects visibility of the data stored for each user.

Available visibility settings:
  - company admin only
  - anyone in a user's review chain
  - everyone in the company
   
The front-end interacts with people attributes via an internal API using React components. Thus, once we add the field to the PeopleAttribute data model, we will need to expose changing the visibility via an implementation function and then expose the behavior via an internal API endpoint.

** AC
1. GET requests for people attributes should include the visibility setting for the attribute
2. POST requests to people attribute detail should accept a visibility parameter that sets the visibility per attribute
3. Only company administrators should be able to update visibility via POST
** Update people attribute editing modal to allow visibility setting via the attribute list page
When opening the people attribute edit modal on the 'Attributes' company setting listing all attributes, admin users should be presented with the three visibility options:

- Admin only
  - Review chain only
  - Everyone

When cancelling ...

*** AC
1. Clicking on "Edit Attribute" button should show modal with options to set attribute visibility
** Obfuscate People Attributes data in the user profile screen when non-admins view the profile page
When a people attributes data field is present in a user profile page, and a non-admin is viewing the page, they should only see asterisks in the data field.

This is already done when Django Admin users log in as a user to protect data.

*** AC
1. As company admin user, viewing a user profile page should show all user attributes and their data
2. As a non-company admin user, viewing a user profile page should show all user attributes. The values for attributes set to 'Everyone' should show values.
** Display read-only widgets for non editable people attributes on user profile page
:PROPERTIES:
:ID:       1a3912ba-eebb-11ea-ad6c-e86a64ecc701
:END:
When a user is editing a user profile page, people attributes marked
*** Acceptance Criteria
1. A company admin editing a user profile should always see editable fields for all people attributes
2. A non-company admin should only see editable fields for people attributes for which they have edit permissions
** Do not expose People Attribute data with Company Admin only visibility settings in data exports
When doing data exports, People Attributes data set to Company Admin only should not be visible in the export.

*** AC
1. Exporting individual data should