X Tutup
Skip to content

User should be able to see their own subadmin groups#38281

Merged
phil-davis merged 3 commits intoowncloud:masterfrom
rpocklin:see-own-subadmin-groups
Mar 2, 2021
Merged

User should be able to see their own subadmin groups#38281
phil-davis merged 3 commits intoowncloud:masterfrom
rpocklin:see-own-subadmin-groups

Conversation

@rpocklin
Copy link
Contributor

@rpocklin rpocklin commented Jan 11, 2021

Description

See related issue below.

Related Issue

Motivation and Context

When logging in, we want to check what groups a user is a subadmin of, so we know what UI to present them with if they can manage specific groups.

Changes to Functionality

Before, you had to be an admin to call this API call. Now, it is implemented in different ways as follows:

a) If you are a regular user and are requesting your own subadmin groups, it will be successful.
b) If you are a regular user and are requesting someone else subadmin groups, it will fail (401).
c) If you are a subadmin and are requesting yourself, or a user who you manage (via groups) it will be successful.
d) If you are a subadmin and are requesting someone else, it will fail (401).
e) If you are an admin and are requesting anyone, it will be successful.

How Has This Been Tested?

Works as expected, normal users can call the owncloud-sdk without an error response (even if they have are not a subadmin of the group) as per the above use cases. There are now unit and acceptance tests in the PR.

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Database schema changes (next release will require increase of minor version instead of patch)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Technical debt
  • Tests only (no source changes)

Checklist:

  • Code changes
  • Unit tests added
  • Acceptance tests added
  • Documentation ticket raised:
  • Changelog item, see TEMPLATE

@phil-davis
Copy link
Contributor

CI is failing https://drone.owncloud.com/owncloud/core/28176 because this PR is branched from an old version of master that has out-of-date drone CI settings.

@rpocklin please pull a current master and rebase to that.

While doing that, you can add a link to this PR into the changelog file.

@rpocklin rpocklin force-pushed the see-own-subadmin-groups branch from d28e313 to 3faf9dd Compare January 11, 2021 04:36
@rpocklin
Copy link
Contributor Author

CI is failing https://drone.owncloud.com/owncloud/core/28176 because this PR is branched from an old version of master that has out-of-date drone CI settings.

@rpocklin please pull a current master and rebase to that.

While doing that, you can add a link to this PR into the changelog file.

Thanks for the feedback, done and done :)

@mmattel mmattel requested review from micbar and phil-davis January 11, 2021 06:28
@mmattel
Copy link
Contributor

mmattel commented Jan 11, 2021

@micbar @phil-davis no reviewer was added before. Pls feel free to add one 😃

Related to #38280

@phil-davis
Copy link
Contributor

drone CI got a silly error: https://drone.owncloud.com/owncloud/core/28180/156/12

Downloading https://github.com/Medium/phantomjs/releases/download/v2.1.1/phantomjs-2.1.1-linux-x86_64.tar.bz2
Saving to /tmp/phantomjs/phantomjs-2.1.1-linux-x86_64.tar.bz2
Receiving...

Error making request.
Error: connect ETIMEDOUT 52.217.17.156:443
    at TCPConnectWrap.afterConnect [as oncomplete] (net.js:1191:14)

I have restarted CI. I expect that it will pass.

@mmattel
Copy link
Contributor

mmattel commented Jan 11, 2021

https://drone.owncloud.com/owncloud/core/28182 --> ERR_TUNNEL_CONNECTION_FAILED

@sonarqubecloud
Copy link

Kudos, SonarCloud Quality Gate passed!

Bug A 0 Bugs
Vulnerability A 0 Vulnerabilities
Security Hotspot A 0 Security Hotspots
Code Smell A 0 Code Smells

No Coverage information No Coverage information
No Duplication information No Duplication information

@phil-davis
Copy link
Contributor

https://drone.owncloud.com/owncloud/core/28182 --> ERR_TUNNEL_CONNECTION_FAILED

It looks green to me. Maybe the drone server had a "hiccup" rendering the results for a second.

@rpocklin rpocklin force-pushed the see-own-subadmin-groups branch from 3faf9dd to 0be4e2a Compare January 12, 2021 00:47
@rpocklin
Copy link
Contributor Author

After further testing I have updated this PR to be more complete, so that it correctly handles admin, subadmin and non-admin users calling this API in the correct manner (for themselves, or for others). I have tested manually but would recommend it have unit or acceptance tests also but I am unable to do this currently due to lack of experience in PHP and time constraints.

@rpocklin rpocklin force-pushed the see-own-subadmin-groups branch from 0be4e2a to 252c7e5 Compare January 12, 2021 02:45
Copy link
Contributor

@phil-davis phil-davis left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There are code-style things to fix https://drone.owncloud.com/owncloud/core/28185/2/7
It would be good to sort those out, then the rest of CI will run and we will see how the various existing API acceptance tests go.

@phil-davis phil-davis self-requested a review January 12, 2021 03:01
@rpocklin rpocklin force-pushed the see-own-subadmin-groups branch from 252c7e5 to 7e4b47b Compare January 12, 2021 04:17
@owncloud owncloud deleted a comment from update-docs bot Jan 12, 2021
@phil-davis
Copy link
Contributor

https://drone.owncloud.com/owncloud/core/28187/2/7 code style is still failing. It needs to get past that so the real tests will run.

@mmattel
Copy link
Contributor

mmattel commented Jan 12, 2021

@rpocklin to fix the code styling tests, run ./make test-php-style-fix from the root of the repo

@rpocklin
Copy link
Contributor Author

Thanks for the instructions guys, will fix this soon.

@rpocklin rpocklin force-pushed the see-own-subadmin-groups branch from 7e4b47b to aa09cf5 Compare January 12, 2021 23:31
@phil-davis
Copy link
Contributor

Some different status codes get returned in unit tests: https://drone.owncloud.com/owncloud/core/28208/9/8

There were 4 failures:

1) OCA\Provisioning_API\Tests\UsersTest::testAddToGroupSuccessfulAsSubadmin
Failed asserting that two objects are equal.
--- Expected
+++ Actual
@@ @@
 OC\OCS\Result Object (
     'data' => Array ()
     'message' => null
-    'statusCode' => 104
+    'statusCode' => 100
     'items' => null
     'perPage' => null
     'headers' => Array ()
 )

/drone/src/apps/provisioning_api/tests/UsersTest.php:1949

2) OCA\Provisioning_API\Tests\UsersTest::testGetUserSubAdminGroupsNotExistingTargetUser
Failed asserting that two objects are equal.
--- Expected
+++ Actual
@@ @@
 OC\OCS\Result Object (
     'data' => Array ()
-    'message' => 'User does not exist'
-    'statusCode' => 101
+    'message' => null
+    'statusCode' => 997
     'items' => null
     'perPage' => null
     'headers' => Array ()
 )

/drone/src/apps/provisioning_api/tests/UsersTest.php:2517

3) OCA\Provisioning_API\Tests\UsersTest::testGetUserSubAdminGroupsWithGroups
Failed asserting that two objects are equal.
--- Expected
+++ Actual
@@ @@
 OC\OCS\Result Object (
     'data' => Array (
-        0 => 'TargetGroup'
     )
     'message' => null
-    'statusCode' => 100
+    'statusCode' => 997
     'items' => null
     'perPage' => null
     'headers' => Array ()
 )

/drone/src/apps/provisioning_api/tests/UsersTest.php:2545

4) OCA\Provisioning_API\Tests\UsersTest::testGetUserSubAdminGroupsWithoutGroups
Failed asserting that two objects are equal.
--- Expected
+++ Actual
@@ @@
 OC\OCS\Result Object (
     'data' => Array ()
-    'message' => 'Unknown error occurred'
-    'statusCode' => 102
+    'message' => null
+    'statusCode' => 997
     'items' => null
     'perPage' => null
     'headers' => Array ()
 )

/drone/src/apps/provisioning_api/tests/UsersTest.php:2568

That needs to be sorted out. It looks to me like more 997 is happening now than should be. I am expecting that only a few test cases will need to change, and those changes should be that a subadmin can "see" their group better than before.

@phil-davis
Copy link
Contributor

https://drone.owncloud.com/owncloud/core/28208/59/13 API acceptance test fails:

  Scenario: a subadmin cannot add users to groups the subadmin is responsible for                                 # /drone/src/tests/acceptance/features/apiProvisioningGroups-v1/addToGroup.feature:133
    Given these users have been created with default attributes and skeleton files:                               # FeatureContext::theseUsersHaveBeenCreated()
      | username       |
      | brand-new-user |
      | subadmin       |
    And group "brand-new-group" has been created                                                                  # FeatureContext::groupHasBeenCreated()
    And user "subadmin" has been made a subadmin of group "brand-new-group"                                       # FeatureContext::userHasBeenMadeSubadminOfGroup()
    When user "subadmin" tries to add user "brand-new-user" to group "brand-new-group" using the provisioning API # FeatureContext::userTriesToAddUserToGroupUsingTheProvisioningApi()
    Then the OCS status code should be "104"                                                                      # OCSContext::theOCSStatusCodeShouldBe()
      OCS status code is not the expected value 104 got 100
      Failed asserting that two strings are equal.
      --- Expected
      +++ Actual
      @@ @@
      -'104'
      +'100'
    And the HTTP status code should be "200"                                                                      # FeatureContext::thenTheHTTPStatusCodeShouldBe()
    And user "brand-new-user" should not belong to group "brand-new-group"                                        # FeatureContext::userShouldNotBelongToGroup()

The sub-admin can now add a member to the group. That ability was removed in PR #31337 back in 2018, because it allows a sub-admin to add any user to "their" group and then change the user's password (thus being able to access the user's data) or delete the user (the sub-admin could delete every other user on the system, leaving just 1 real admin and themselves!)
Also see my comment #38279 (comment)

This PR currently does more than its current title: "User should be able to see their own subadmin groups"

IMO we should just fix the "see their own subadmin groups" thing, get that done, and we can have a separate discussion about changing what a sub-admin can and cannot do.

@rpocklin
Copy link
Contributor Author

rpocklin commented Jan 15, 2021

https://drone.owncloud.com/owncloud/core/28208/59/13 API acceptance test fails:

  Scenario: a subadmin cannot add users to groups the subadmin is responsible for                                 # /drone/src/tests/acceptance/features/apiProvisioningGroups-v1/addToGroup.feature:133
    Given these users have been created with default attributes and skeleton files:                               # FeatureContext::theseUsersHaveBeenCreated()
      | username       |
      | brand-new-user |
      | subadmin       |
    And group "brand-new-group" has been created                                                                  # FeatureContext::groupHasBeenCreated()
    And user "subadmin" has been made a subadmin of group "brand-new-group"                                       # FeatureContext::userHasBeenMadeSubadminOfGroup()
    When user "subadmin" tries to add user "brand-new-user" to group "brand-new-group" using the provisioning API # FeatureContext::userTriesToAddUserToGroupUsingTheProvisioningApi()
    Then the OCS status code should be "104"                                                                      # OCSContext::theOCSStatusCodeShouldBe()
      OCS status code is not the expected value 104 got 100
      Failed asserting that two strings are equal.
      --- Expected
      +++ Actual
      @@ @@
      -'104'
      +'100'
    And the HTTP status code should be "200"                                                                      # FeatureContext::thenTheHTTPStatusCodeShouldBe()
    And user "brand-new-user" should not belong to group "brand-new-group"                                        # FeatureContext::userShouldNotBelongToGroup()

The sub-admin can now add a member to the group. That ability was removed in PR #31337 back in 2018, because it allows a sub-admin to add any user to "their" group and then change the user's password (thus being able to access the user's data) or delete the user (the sub-admin could delete every other user on the system, leaving just 1 real admin and themselves!)
Also see my comment #38279 (comment)

This PR currently does more than its current title: "User should be able to see their own subadmin groups"

IMO we should just fix the "see their own subadmin groups" thing, get that done, and we can have a separate discussion about changing what a sub-admin can and cannot do.

Apologies, the change in addToGroup was inadvertently added from another current PR I am working on, I will remove it so we can focus on getUserSubAdminGroups as that is the intent here.

I've updated the PR, less tests should break now, can you please re-review.

@rpocklin rpocklin force-pushed the see-own-subadmin-groups branch from aa09cf5 to e7dc19f Compare January 15, 2021 06:06
@rpocklin
Copy link
Contributor Author

rpocklin commented Feb 15, 2021

@phil-davis I am attempting to investigate the failures (which are less now) but phpunit tests keep freezing at 48% on my Ubuntu, are you able to offer suggestions? I am not familiar with PHP or their toolkits, and i'm using mariadb locally.

GNU Make 4.2.1
Built for x86_64-pc-linux-gnu
Copyright (C) 1988-2016 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Reading makefiles...
Updating makefiles....
Updating goal targets....
 File 'test-php-unit' does not exist.
Must remake target 'test-php-unit'.
PHPUNIT="/home/robertp/p/core/lib/composer/phpunit/phpunit/phpunit" build/autotest.sh mysql
Using PHP executable /usr/bin/php
Parsing all files in lib/public for the presence of @since or @deprecated on each method...

Using database oc_autotest
Setup environment for mysql testing on local storage ...
Updated 0 paths from the index
Installing ....
ownCloud was successfully installed
Testing with mysql ...
/home/robertp/p/core/lib/composer/phpunit/phpunit/phpunit --configuration phpunit-autotest.xml --coverage-clover autotest-clover-mysql.xml --coverage-html coverage-html-mysql --log-junit autotest-results-mysql.xml
PHPUnit 8.5.14 by Sebastian Bergmann and contributors.

Runtime:       PHP 7.4.3
Configuration: /home/robertp/p/core/tests/phpunit-autotest.xml
Error:         No code coverage driver is available

...........................................................    59 / 10415 (  0%)
..........................S................................   118 / 10415 (  1%)
...........................................................   177 / 10415 (  1%)
...........................................................   236 / 10415 (  2%)
...........................................................   295 / 10415 (  2%)
...........................................................   354 / 10415 (  3%)
...........................................................   413 / 10415 (  3%)
...........................................................   472 / 10415 (  4%)
...........................................................   531 / 10415 (  5%)
...........................................................   590 / 10415 (  5%)
...........................................................   649 / 10415 (  6%)
...........................................................   708 / 10415 (  6%)
...........................................................   767 / 10415 (  7%)
...........................................................   826 / 10415 (  7%)
...........................................................   885 / 10415 (  8%)
...........................................................   944 / 10415 (  9%)
...........................................................  1003 / 10415 (  9%)
...........................................................  1062 / 10415 ( 10%)
...........................................................  1121 / 10415 ( 10%)
...........................................................  1180 / 10415 ( 11%)
...........................................................  1239 / 10415 ( 11%)
...........................................SS..............  1298 / 10415 ( 12%)
...........................................................  1357 / 10415 ( 13%)
...........................................................  1416 / 10415 ( 13%)
...........................................................  1475 / 10415 ( 14%)
...........................................................  1534 / 10415 ( 14%)
...........................................................  1593 / 10415 ( 15%)
...........................................................  1652 / 10415 ( 15%)
...........................................................  1711 / 10415 ( 16%)
...........................................................  1770 / 10415 ( 16%)
...........................................................  1829 / 10415 ( 17%)
...........................................................  1888 / 10415 ( 18%)
...........................................................  1947 / 10415 ( 18%)
...........................................................  2006 / 10415 ( 19%)
...........................................................  2065 / 10415 ( 19%)
...........................................................  2124 / 10415 ( 20%)
...........................................................  2183 / 10415 ( 20%)
...........................................................  2242 / 10415 ( 21%)
...........................................................  2301 / 10415 ( 22%)
...........................................................  2360 / 10415 ( 22%)
...........................................................  2419 / 10415 ( 23%)
...........................................................  2478 / 10415 ( 23%)
...........................................................  2537 / 10415 ( 24%)
...........................................................  2596 / 10415 ( 24%)
...........................................................  2655 / 10415 ( 25%)
...........................................................  2714 / 10415 ( 26%)
...........................................................  2773 / 10415 ( 26%)
...........................................................  2832 / 10415 ( 27%)
...........................................................  2891 / 10415 ( 27%)
...........................................................  2950 / 10415 ( 28%)
..............................................S............  3009 / 10415 ( 28%)
...........................................................  3068 / 10415 ( 29%)
...........................................................  3127 / 10415 ( 30%)
..................S........................................  3186 / 10415 ( 30%)
...................................................S.......  3245 / 10415 ( 31%)
...........................................................  3304 / 10415 ( 31%)
..................................S........................  3363 / 10415 ( 32%)
...........................................................  3422 / 10415 ( 32%)
................S..........................................  3481 / 10415 ( 33%)
..............................................S............  3540 / 10415 ( 33%)
...........................................................  3599 / 10415 ( 34%)
...........................................................  3658 / 10415 ( 35%)
...........................................................  3717 / 10415 ( 35%)
...........................................................  3776 / 10415 ( 36%)
...........................................................  3835 / 10415 ( 36%)
...........................................................  3894 / 10415 ( 37%)
...........................................................  3953 / 10415 ( 37%)
...........................................................  4012 / 10415 ( 38%)
...........................................................  4071 / 10415 ( 39%)
...........................................................  4130 / 10415 ( 39%)
...........................................................  4189 / 10415 ( 40%)
...........................................................  4248 / 10415 ( 40%)
.....................................................FF....  4307 / 10415 ( 41%)
...........................................................  4366 / 10415 ( 41%)
...........................................................  4425 / 10415 ( 42%)
...........................................................  4484 / 10415 ( 43%)
...........................................................  4543 / 10415 ( 43%)
...........................................................  4602 / 10415 ( 44%)
...........................................................  4661 / 10415 ( 44%)
...........................................................  4720 / 10415 ( 45%)
...............SSSSSSSSSSSSSSSSSS..........................  4779 / 10415 ( 45%)
..SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS.....................  4838 / 10415 ( 46%)
...........................................................  4897 / 10415 ( 47%)
...........................................................  4956 / 10415 ( 47%)
...........................................................  5015 / 10415 ( 48%)
...........................FFFF........

@phil-davis
Copy link
Contributor

I know that some of the unit tests somehow use a lot of memory. You can run just the test(s) that you know are a probledm, get those passing, and let CI run the full suite. Something like:

make test-php-unit NOCOVERAGE=true TEST_PHP_SUITE=apps/provisioning_api/tests/UsersTest.php

@rpocklin
Copy link
Contributor Author

I know that some of the unit tests somehow use a lot of memory. You can run just the test(s) that you know are a probledm, get those passing, and let CI run the full suite. Something like:

make test-php-unit NOCOVERAGE=true TEST_PHP_SUITE=apps/provisioning_api/tests/UsersTest.php

Thanks that helped me move forward cheers.

@rpocklin rpocklin force-pushed the see-own-subadmin-groups branch from e18fa1e to 6c09d22 Compare February 21, 2021 22:23
@rpocklin
Copy link
Contributor Author

I keep getting the following error running the test-acceptance-api tests locally, any ideas?

Nothing to install or update
Generating autoload files
composer/package-versions-deprecated: Generating version class...
composer/package-versions-deprecated: ...done generating version class
61 packages you are using are looking for funding.
Use the `composer fund` command to find out more!
./tests/acceptance/run.sh --type api
Script path: /home/robertp/p/core/tests/acceptance
Using php inbuilt server for running scenario ...
8080
6151
8180
6152
[Tue Feb 23 17:12:15 2021] PHP 7.4.3 Development Server (http://localhost:8180) started
[Tue Feb 23 17:12:15 2021] PHP 7.4.3 Development Server (http://localhost:8080) started
[Tue Feb 23 17:12:20 2021] 127.0.0.1:38312 Accepted
[Tue Feb 23 17:12:20 2021] 127.0.0.1:38312 [302]: POST /ocs/v2.php/apps/testing/api/v1/occ
[Tue Feb 23 17:12:20 2021] 127.0.0.1:38312 Closing
-:2: parser error : Start tag expected, '<' not found

^
[Tue Feb 23 17:12:20 2021] 127.0.0.1:38314 Accepted
[Tue Feb 23 17:12:20 2021] 127.0.0.1:38314 [302]: POST /ocs/v2.php/apps/testing/api/v1/occ
[Tue Feb 23 17:12:20 2021] 127.0.0.1:38314 Closing
-:2: parser error : Start tag expected, '<' not found

^
Could not set mail_domain on http://localhost:8080/ocs/v2.php/apps/testing/api/v1/occ. Result:
''
[Tue Feb 23 17:12:20 2021] 127.0.0.1:38316 Accepted
[Tue Feb 23 17:12:20 2021] 127.0.0.1:38316 [302]: POST /ocs/v2.php/apps/testing/api/v1/occ
[Tue Feb 23 17:12:20 2021] 127.0.0.1:38316 Closing
-:2: parser error : Start tag expected, '<' not found

^
runsh: Exit code of main run:
make: *** [Makefile:207: test-acceptance-api] Error 1```

@rpocklin
Copy link
Contributor Author

rpocklin commented Feb 26, 2021

Thanks @phil-davis I believe it all passes now =) Someone added in the acceptance tests relating to this @issue-owncloud-sdk-658 for me, which was helpful and thoughtful.

@phil-davis phil-davis force-pushed the see-own-subadmin-groups branch from 80f4eeb to ef49d63 Compare February 26, 2021 05:05
@phil-davis
Copy link
Contributor

The code looked like it will now allow an ordinary user who is not a subadmin of any groups to query about what groups they are sub-admin of, so I added an acceptance test scenario for that. They get "success" OCS and HTTP status with an empty list - which seems correct.

Copy link
Contributor

@phil-davis phil-davis left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM - also needs review from a developer.

@owncloud owncloud deleted a comment from phil-davis Feb 26, 2021
@AlexAndBear AlexAndBear self-requested a review February 26, 2021 10:21
@owncloud owncloud deleted a comment from VicDeo Feb 26, 2021
@rpocklin
Copy link
Contributor Author

The code looked like it will now allow an ordinary user who is not a subadmin of any groups to query about what groups they are sub-admin of, so I added an acceptance test scenario for that. They get "success" OCS and HTTP status with an empty list - which seems correct.

Yep that's right, thanks for adding that.

@phil-davis
Copy link
Contributor

@janackermann IMO this is ready. Please review again.

@AlexAndBear
Copy link

Unit Tests are failing

@rpocklin rpocklin force-pushed the see-own-subadmin-groups branch 2 times, most recently from eafc229 to b736dc2 Compare March 1, 2021 05:23
@rpocklin rpocklin force-pushed the see-own-subadmin-groups branch from b736dc2 to 3225ce1 Compare March 1, 2021 07:15
@rpocklin rpocklin force-pushed the see-own-subadmin-groups branch from 3225ce1 to d246fe4 Compare March 2, 2021 00:12
@sonarqubecloud
Copy link

sonarqubecloud bot commented Mar 2, 2021

Kudos, SonarCloud Quality Gate passed!

Bug A 0 Bugs
Vulnerability A 0 Vulnerabilities
Security Hotspot A 0 Security Hotspots
Code Smell A 0 Code Smells

No Coverage information No Coverage information
No Duplication information No Duplication information

@rpocklin
Copy link
Contributor Author

rpocklin commented Mar 2, 2021

Updated the tests, everything passes now. Incorporating the change @janackermann suggested meant I needed to update the tests/acceptance/features/apiProvisioningGroups-v2/getSubAdminGroups.feature file to change the OCS and HTTP response code from 400 to 404.

@phil-davis phil-davis merged commit 0d66881 into owncloud:master Mar 2, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Calling getUserSubadminGroups with OC10 backend gives 401 Unauthorised

5 participants

X Tutup