Prevent administrators from viewing Activity Delegates for self assessments in a category that doesn't match their own

[ABSinhaa]

JIRA link

TD-4880

Description

Added a check for the categoryId of the admin users while fetching the self assessments, making sure we only pull the self assessments that matches the categoryId on the admin account of the user, also added an Unauthorized check when anyone tries to manipulate the self assessment delegates using the query string URL being opened.
If there's a categoryId on the admin account of the user, then show self assessments that are specific to the categoryId, if there's no categoryId on the admin account of the user, continue showing all the self assessments.

Screenshots

When categoryId is set to null on the admin account, the user can see all the self assessments and can access delegates from all the self assessments.

When categoryid has a value on the admin account, the user can only see the self assessments with that specific categoryID.
In the below example categoryId is set to 34 and it has only 5 assessments that have the same categoryId on them.

If the user tries to manipulate the URL and passess a different selfAssessmentId in the querystring parameter and that self assessment has a different categoryId on it which doesn't match with the one on the user's admin account then show an Unauthorised page.

---

Developer checks

(Leave tasks unticked if they haven't been appropriate for your ticket.)

I have:

• Run the formatter and made sure there are no IDE errors (see info on Text Editor settings to avoid whitespace changes)
• Written tests for the changes (accessibility tests, unit tests for controller, data services, services, view models, etc)
• Manually tested my work with and without JavaScript
• Tested any Views or partials created or changed with Wave Chrome plugin and addressed any valid accessibility issues
• Updated/added documentation in Confluence and/or GitHub Readme. List of documentation links added/changed:
  • doc_1_here
• Updated my Jira ticket with information about other parts of the system that were touched as part of the MR and have to be sanity tested to ensure nothing’s broken
• Scanned over my pull request in GitHub and addressed any warnings from the GitHub Build and Test checks.

[sherif-olaboye]

The pr look ok

[Auldrin-Possa]

Looks good