User should be able to see their own subadmin groups#38281
User should be able to see their own subadmin groups#38281phil-davis merged 3 commits intoowncloud:masterfrom
Conversation
|
CI is failing https://drone.owncloud.com/owncloud/core/28176 because this PR is branched from an old version of master that has out-of-date drone CI settings. @rpocklin please pull a current master and rebase to that. While doing that, you can add a link to this PR into the changelog file. |
d28e313 to
3faf9dd
Compare
Thanks for the feedback, done and done :) |
|
@micbar @phil-davis no reviewer was added before. Pls feel free to add one 😃 Related to #38280 |
|
drone CI got a silly error: https://drone.owncloud.com/owncloud/core/28180/156/12 I have restarted CI. I expect that it will pass. |
|
https://drone.owncloud.com/owncloud/core/28182 --> ERR_TUNNEL_CONNECTION_FAILED |
|
Kudos, SonarCloud Quality Gate passed! |
It looks green to me. Maybe the drone server had a "hiccup" rendering the results for a second. |
3faf9dd to
0be4e2a
Compare
|
After further testing I have updated this PR to be more complete, so that it correctly handles admin, subadmin and non-admin users calling this API in the correct manner (for themselves, or for others). I have tested manually but would recommend it have unit or acceptance tests also but I am unable to do this currently due to lack of experience in PHP and time constraints. |
0be4e2a to
252c7e5
Compare
phil-davis
left a comment
There was a problem hiding this comment.
There are code-style things to fix https://drone.owncloud.com/owncloud/core/28185/2/7
It would be good to sort those out, then the rest of CI will run and we will see how the various existing API acceptance tests go.
252c7e5 to
7e4b47b
Compare
|
https://drone.owncloud.com/owncloud/core/28187/2/7 code style is still failing. It needs to get past that so the real tests will run. |
|
@rpocklin to fix the code styling tests, run |
|
Thanks for the instructions guys, will fix this soon. |
7e4b47b to
aa09cf5
Compare
|
Some different status codes get returned in unit tests: https://drone.owncloud.com/owncloud/core/28208/9/8 That needs to be sorted out. It looks to me like more |
|
https://drone.owncloud.com/owncloud/core/28208/59/13 API acceptance test fails: The sub-admin can now add a member to the group. That ability was removed in PR #31337 back in 2018, because it allows a sub-admin to add any user to "their" group and then change the user's password (thus being able to access the user's data) or delete the user (the sub-admin could delete every other user on the system, leaving just 1 real admin and themselves!) This PR currently does more than its current title: "User should be able to see their own subadmin groups" IMO we should just fix the "see their own subadmin groups" thing, get that done, and we can have a separate discussion about changing what a sub-admin can and cannot do. |
Apologies, the change in I've updated the PR, less tests should break now, can you please re-review. |
aa09cf5 to
e7dc19f
Compare
|
@phil-davis I am attempting to investigate the failures (which are less now) but phpunit tests keep freezing at 48% on my Ubuntu, are you able to offer suggestions? I am not familiar with PHP or their toolkits, and i'm using mariadb locally. |
|
I know that some of the unit tests somehow use a lot of memory. You can run just the test(s) that you know are a probledm, get those passing, and let CI run the full suite. Something like: |
Thanks that helped me move forward cheers. |
e18fa1e to
6c09d22
Compare
|
I keep getting the following error running the test-acceptance-api tests locally, any ideas? |
|
Thanks @phil-davis I believe it all passes now =) Someone added in the acceptance tests relating to this @issue-owncloud-sdk-658 for me, which was helpful and thoughtful. |
80f4eeb to
ef49d63
Compare
|
The code looked like it will now allow an ordinary user who is not a subadmin of any groups to query about what groups they are sub-admin of, so I added an acceptance test scenario for that. They get "success" OCS and HTTP status with an empty list - which seems correct. |
phil-davis
left a comment
There was a problem hiding this comment.
LGTM - also needs review from a developer.
Yep that's right, thanks for adding that. |
|
@janackermann IMO this is ready. Please review again. |
|
Unit Tests are failing |
eafc229 to
b736dc2
Compare
b736dc2 to
3225ce1
Compare
3225ce1 to
d246fe4
Compare
|
Kudos, SonarCloud Quality Gate passed! |
|
Updated the tests, everything passes now. Incorporating the change @janackermann suggested meant I needed to update the |
Description
See related issue below.
Related Issue
getUserSubadminGroupswith OC10 backend gives 401 Unauthorised owncloud-sdk#658Motivation and Context
When logging in, we want to check what groups a user is a subadmin of, so we know what UI to present them with if they can manage specific groups.
Changes to Functionality
Before, you had to be an admin to call this API call. Now, it is implemented in different ways as follows:
a) If you are a regular user and are requesting your own subadmin groups, it will be successful.
b) If you are a regular user and are requesting someone else subadmin groups, it will fail (401).
c) If you are a subadmin and are requesting yourself, or a user who you manage (via groups) it will be successful.
d) If you are a subadmin and are requesting someone else, it will fail (401).
e) If you are an admin and are requesting anyone, it will be successful.
How Has This Been Tested?
Works as expected, normal users can call the owncloud-sdk without an error response (even if they have are not a subadmin of the group) as per the above use cases. There are now unit and acceptance tests in the PR.
Types of changes
Checklist: