Removing other CircleMembers: permissions

When I am an admin of a circle and I click edit circle, I am given a list of members, but I can only remove myself

This happens because the permission check for delete on this resource (circle-members/x/) is on the CircleMember object, which gives you permission to delete yourself and view or add if you are authenticated (https://git.happy-dev.fr/startinblox/djangoldp-packages/djangoldp-circle/blob/master/djangoldp_circle/models.py#L53)

I think that the permission check should be checking if the current user is an admin of the circle, but I need some guidance with this @jbpasquier ?

It's all server side permissions.

I guess it's what you did there, no? https://git.happy-dev.fr/startinblox/djangoldp-packages/djangoldp-circle/blob/master/djangoldp_circle/permissions.py#L76

The issue is that the button "remove from circle" isn't displayed next to user Alex (I am an admin on this circle)

The code for displaying this button is from the sib-ac-checker here: https://git.happy-dev.fr/startinblox/applications/sib-app/blob/master/src/page-circle-edit.pug#L21

The ID it checks with is for CircleMember Alex, and I think that this comes from the DjangoLDP permission classes here: https://git.happy-dev.fr/startinblox/djangoldp-packages/djangoldp-circle/blob/master/djangoldp_circle/models.py#L53, so it doesn't check the custom permissions in permissions.py?

The front-end check if you, as anyone, can delete CircleMember Alex, so it goes there too.

You pointed the Meta of CircleMember that have permission_classes = [CircleMemberPermissions].

It's all there. :)

Ah okay so it does check the permission_classes? But do you have an idea why the ac checker isn't displaying remove for any CircleMember except myself?

I bet that if you go to your api, you have no permission for this member?

I can't get Postman to work to know for sure, what's your method for testing like this?

reading the code I definitely should have the permission- I'm admin and owner, they are just a regular member.. I've tested also on other circles, by adding more members etc. I think if it's not checking the custom permission_class, the explanation fits neatly?

I usually make a debug point on server, then I use the front-end as usual. But you can just log something on each step, it'll also do the job.

By reading it I spotted if obj.pk == request.user.pk:, shouldn't it be if obj.user.pk == request.user.pk: instead?

Also elif obj.is_admin: make every admin incapable of removing themself.

changed milestone to %10

closed

changed milestone to %Circles part I