A partly selected group does not authorise every document

A document portal may show the right selected rows but prepare the wrong download. If the visible group checkbox is being used as a shortcut for the actual selection, a partial choice can accidentally expand into all documents.

This example is fictional and uses public demonstration documents. Its download action creates a test pack, not an access grant or an operation on a real customer account.

Reproduce the smallest incorrect choice

The group contains three selectable documents, D-21, D-22 and D-23. A fourth row, D-24, is disabled because it is outside the current user's permitted action. The user selects only D-21.

The child row is correctly checked. The parent “select all” control displays a mixed mark. Yet the prepared test pack contains D-21, D-22 and D-23. The defect is observable in the output, not merely in the icon.

The investigator follows the submitted IDs. The pack service receives all three allowed IDs because the browser's preparation function expands the parent state into the whole group. The service has not invented the extra rows, and the selected-child model still contains only D-21.

Inspect what the parent state means

The parent checkbox's indeterminate property is true, and its separate checked property is also true in this implementation. That combination can exist. MDN explains that indeterminate appearance is independent of checkedness.

The faulty preparation function asks only whether the parent is checked. It interprets that answer as an instruction to include every eligible child. The mixed appearance is therefore not an authoritative description of the selected set.

Changing the mixed mark's colour would not repair the pack. Neither would relying on a single hidden parent value at submission. The action needs the actual child identifiers chosen by the user, validated against the allowed operation.

Retain the working model and repair the boundary

The current portal already stores a distinct set of selected child IDs. The approved repair makes the pack action read that set instead of deriving it from the parent. It also derives the parent's ordinary, empty or mixed appearance from the eligible children's current selection.

The documented select-all command still selects all eligible rows when the user deliberately activates it. That command is separate from preparing a pack. A visual summary does not become a new selection instruction merely because another button is pressed.

The server continues to check each requested document against the user's permissions and the operation's rules. Client-side selection is not a security boundary. D-24's disabled appearance cannot be the only protection against a crafted request.

The owner chooses this focused repair because the underlying document identities and selection model are adequate. Rebuilding the portal would add work without explaining this specific cause. Other unresolved defects would still need their own assessment.

Verify the exact output sets

In the corrected fictional replay, selecting D-21 prepares a pack containing only D-21. Selecting D-21 and D-23 produces exactly those two documents; D-22 remains absent. The selection display is mixed in both cases, but the output does not depend on guessing which mixed state was intended.

Deliberately selecting all eligible rows produces D-21, D-22 and D-23. Clearing all selections leaves the action unavailable and creates no empty pack. D-24 is absent in every permitted case.

An isolated direct request containing D-24 is denied by the server rule. A control group with different documents retains its previous selection after the repair. The acceptance record includes requested IDs, permitted IDs and final pack membership, rather than just screenshots of tick marks.

Leave an explanation the maintainer can use

The handover describes the child set as the action's input, the parent as a control and summary, and the server as the permission authority. It records the faulty branch and the partial, full, empty and forbidden controls.

Keyboard and focus behaviour still need to be checked in the implemented interface. This single correction does not establish complete accessibility or security. Its demonstrated result is narrower and useful: the pack now contains the permitted documents the user actually selected.

Bring a reproducible choice and its resulting output to the software repair service. Comparing those two sets can reveal a smaller, clearer intervention than a broad request to replace an unreliable portal.