From f4e402fc8750404b84fed7f66d0da0a4b36c5c6a Mon Sep 17 00:00:00 2001
From: b0ink <40929320+b0ink@users.noreply.github.com>
Date: Fri, 23 Oct 2026 13:49:06 +1100
Subject: [PATCH] fix: restrict global learning outcome changes to admins

---
 app/models/learning_outcome.rb                |  4 +---
 app/models/user.rb                            |  6 ++---
 .../api/feedback/learning_outcome_api_test.rb | 23 +++++++++++++++++++
 3 files changed, 26 insertions(+), 7 deletions(-)

diff --git a/app/models/learning_outcome.rb b/app/models/learning_outcome.rb
index db074a1a50..7494d36ec5 100644
--- a/app/models/learning_outcome.rb
+++ b/app/models/learning_outcome.rb
@@ -19,7 +19,6 @@ def self.permissions
     convenor_role_permissions = [
       :update,
       :get_los,
-      :update_glos,
       :upload_csv,
       :create_feedback_chips,
       :get_feedback_chips
@@ -36,8 +35,7 @@ def self.permissions
 
     tutor_role_permissions = [
       :update,
-      :get_los,
-      :update_glos
+      :get_los
     ]
 
     auditor_role_permissions = [
diff --git a/app/models/user.rb b/app/models/user.rb
index 6066b148f8..96eb6e5afe 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -394,8 +394,7 @@ def self.permissions
       :get_scorm_token,
 
       :get_feedback_chips,
-      :get_los,
-      :update_glos
+      :get_los
     ]
 
     # What can tutors do with users?
@@ -406,8 +405,7 @@ def self.permissions
       :get_scorm_token,
 
       :get_feedback_chips,
-      :get_los,
-      :update_glos
+      :get_los
     ]
 
     # What can students do with users?
diff --git a/test/api/feedback/learning_outcome_api_test.rb b/test/api/feedback/learning_outcome_api_test.rb
index 14431c27c5..613e33cfd9 100644
--- a/test/api/feedback/learning_outcome_api_test.rb
+++ b/test/api/feedback/learning_outcome_api_test.rb
@@ -195,6 +195,29 @@ def test_update_global_outcome
     assert_json_matches_model learning_outcome, last_response_body, %w[id context_id context_type abbreviation short_description full_outcome_description]
   end
 
+  def test_tutors_and_convenors_cannot_manage_global_outcomes
+    learning_outcome = FactoryBot.create(:learning_outcome, context_id: nil, context_type: nil,
+                                                            short_description: 'Original')
+    new_abbreviation = FactoryBot.build(:learning_outcome).abbreviation
+    new_outcome = { abbreviation: new_abbreviation, short_description: 'New outcome' }
+
+    [FactoryBot.create(:user, :tutor), FactoryBot.create(:user, :convenor)].each do |user|
+      add_auth_header_for user: user
+
+      post_json 'api/global/outcomes', new_outcome
+      assert_equal 403, last_response.status
+      assert_nil LearningOutcome.global_outcomes.find_by(abbreviation: new_abbreviation)
+
+      put_json "api/global/outcomes/#{learning_outcome.id}", short_description: 'Changed'
+      assert_equal 403, last_response.status
+      assert_equal 'Original', learning_outcome.reload.short_description
+
+      delete "api/global/outcomes/#{learning_outcome.id}"
+      assert_equal 403, last_response.status
+      assert LearningOutcome.exists?(learning_outcome.id)
+    end
+  end
+
   def test_create_task_definition_learning_outcome
     task_definition = FactoryBot.create(:task_definition, outcome_count: 0)
     data_to_post = {