FOUR-25264: Prevent Admin menu from appearing for project-only users by switching project user selectors to /users

[eiresendez]

Issue & Reproduction Steps

A non-admin project owner with all project permissions could not add members in Designer because the users_task_count endpoint returned 403. The route is protected by can:view-users, but project managers don’t have that global permission.

1. Create a non-admin user, grant all project permissions, set as project owner.
2. Log in as that user, go to Designer → Projects, open a project and try to add a member.
3. The request to GET /api/1.0/users_task_count fails with 403, showing an authorization error.

Solution

• Override the view-users gate to also allow users with create-projects, enabling project managers/owners to call users_task_count without needing the global view-users permission.

How to Test

1. Ensure a user has create-projects (project manager/owner) but not view-users.
2. Log in as that user and navigate to Designer → Projects → open a project.
3. Use the member selector; adding/searching members should succeed, and GET /api/1.0/users_task_count should return 200 instead of 403.

Related Tickets & Packages

• FOUR-25264
• FOUR-28486
• Projects PR

ci:deploy
ci:package-projects:bugfix/FOUR-25264

Code Review Checklist

• I have pulled this code locally and tested it on my instance, along with any associated packages.
• This code adheres to ProcessMaker Coding Guidelines.
• This code includes a unit test or an E2E test that tests its functionality, or is covered by an existing test.
• This solution fixes the bug reported in the original ticket.
• This solution does not alter the expected output of a component in a way that would break existing Processes.
• This solution does not implement any breaking changes that would invalidate documentation or cause existing Processes to fail.
• This solution has been tested with enterprise packages that rely on its functionality and does not introduce bugs in those packages.
• This code does not duplicate functionality that already exists in the framework or in ProcessMaker.
• This ticket conforms to the PRD associated with this part of ProcessMaker.

[vladyrichter]

QA server K8S was successfully deployed https://ci-578647db74.engk8s.processmaker.net

[vladyrichter]

QA server K8S was successfully deployed https://ci-578647db74.engk8s.processmaker.net

[vladyrichter]

QA server K8S was successfully deployed https://ci-578647db74.engk8s.processmaker.net

[processmaker-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarQube

[CarliPinell]

approved!