Federation - Can not set distant user as owner of a circle

How is it now?

When I try to set a distant user as owner of a circle, the PATCH request sends a 200 OK, but nothing changes in the datas.

How should it be?

The owner should be the selected user

Steps to reproduce

1. In config.json, change circles and users endpoints:

"circles": "https://api.test-paris.happy-dev.fr/sources/circles/",
"users": "https://api.test-paris.happy-dev.fr/sources/users/"

2. Go in a circle where you are admin
3. Select a user from test-nantes in the owner list and save
4. Check the data in https://api.test-paris.happy-dev.fr/circles/X/, you should still see the same owner than at the beginning

added 1 deleted label

assigned to @jbpasquier

changed milestone to %Federation part I

mentioned in issue management/core-team#3

unassigned @jbpasquier

On test1.startinblox.com I have this:

It seems the widget is displayed as 'sib-form-autocompletion' (https://git.startinblox.com/applications/hubl/blob/master/src/views/circle/page-circle-edit.pug#L63)

Which is populating it from test1/users/, right?

This returns only local users so I think it should be /sources/users/ or similar? @jbpasquier @matthieu

No, populated from range-owner="${endpoints.users || endpoints.get.users}", in case of a federation your endpoints.get.users is the /sources/users/

Checked on test1, I added names to your test1 users, I have the admin of test2 on the list (blank name, I'm not admin can't update).

The list generation works fine.

Tested on test1, still the same.

Here I'm on test1 frontend, logged in as a test1 user, updating on of my Circle on test1 to give it to Admin Admin (test2 user).

Request URL: https://api.test1.startinblox.com/circles/21/

Request body:

{"description":"On test1","name":"I like Circle (Test1)","owner":{"@id":"https://api.test2.startinblox.com/users/admin/"},"@id":"https://api.test1.startinblox.com/circles/21/","@context":{"@vocab":"http://happy-dev.fr/owl/#","rdf":"http://www.w3.org/1999/02/22-rdf-syntax-ns#","rdfs":"http://www.w3.org/2000/01/rdf-schema#","ldp":"http://www.w3.org/ns/ldp#","foaf":"http://xmlns.com/foaf/0.1/","name":"rdfs:label","acl":"http://www.w3.org/ns/auth/acl#","permissions":"acl:accessControl","mode":"acl:mode","geo":"http://www.w3.org/2003/01/geo/wgs84_pos#","lat":"geo:lat","lng":"geo:long","inbox":"http://happy-dev.fr/owl/#inbox","object":"http://happy-dev.fr/owl/#object","author":"http://happy-dev.fr/owl/#author","account":"http://happy-dev.fr/owl/#account","jabberID":"foaf:jabberID","picture":"foaf:depiction"}}

Response:

{"@id":"https://api.test1.startinblox.com/circles/21/","is_backlink":false,"allow_create_backlink":true,"name":"I like Circle (Test1)","description":"On test1","creationDate":"2020-05-06","status":"Public","jabberID":"bzf2qh50a3hf@conference.test1.startinblox.com","jabberRoom":true,"team":{"@id":"https://api.test1.startinblox.com/circles/21/team/","@type":"ldp:Container","ldp:contains":[{"@id":"https://api.test1.startinblox.com/users/jbpasquier/"}],"permissions":[{"mode":{"@type":"add"}},{"mode":{"@type":"view"}}]},"members":{"@id":"https://api.test1.startinblox.com/circles/21/members/","@type":"ldp:Container","ldp:contains":[{"@id":"https://api.test1.startinblox.com/circle-members/158/"},{"@id":"https://api.test1.startinblox.com/circle-members/157/"}],"permissions":[{"mode":{"@type":"add"}},{"mode":{"@type":"view"}}]},"@type":"hd:circle","permissions":[{"mode":{"@type":"view"}},{"mode":{"@type":"change"}},{"mode":{"@type":"delete"}}],"@context":"https://cdn.happy-dev.fr/owl/hdcontext.jsonld"}

Fun fact, no owner field on the response. On app, it's still me the owner.

After testing, I found that this is also an issue with setting a local user as owner as well

JSONLDParser is removing owner from the request before it reaches the view, because it can't expand the key into an absolute IRI

nicely tucked away in the JSON-LD spec:

JSON keys that do not expand to an IRI, such as status in the example above, are not Linked Data and thus ignored when processed.

But there is no difference between owner and name for example right?

Is the owner saved? Or is it removed just when it's parsed to be sent as a response?

name is defined in the context of the request: name: "rdfs:label"

It's not saved, because it's removed from the request before it reaches the view (when it's parsed)

name is defined in the context of the request: name: "rdfs:label"

Yes true, but for description then? I don't get why this particular predicate for this particular request is an issue, but it seems to work everywhere else.

It's not saved, because it's removed from the request before it reaches the view (when it's parsed)

OK

ouf sorry this was a mistake in my unit test

The problem is caused by the behaviour of auto_author, which in Circle is set to the owner field

In the LDPSerializer get_default_fields is overriden to prevent author fields being accessed or edited in POST/PATCH requests: https://git.startinblox.com/djangoldp-packages/djangoldp/blob/master/djangoldp/serializers.py#L274

This effectively makes author read-only, which I don't think should be the default behaviour

@balessan JB mentioned that some clients might be expecting this behaviour, e.g. u4e?

I've opened djangoldp-packages/djangoldp#239 and proposed an alternative system to make fields read-only

changed time estimate to 4d 2h

added 4h of time spent at 2020-05-13

changed time estimate to 4h 30m

added 30m of time spent at 2020-05-17

closed