403 on adding a user to a private circle

• I'm logged in as user: https://api.test2.startinblox.com/users/jbpasquier/
• On frontend https://test2.startinblox.com
• I want to add the user https://api.test1.startinblox.com/users/jbpasquier/ to my circle https://api.test2.startinblox.com/circles/2/
• I get a 403.

Payload:

{"user":{"@id":"https://api.test1.startinblox.com/users/jbpasquier/"},"@context":{"@vocab":"http://happy-dev.fr/owl/#","rdf":"http://www.w3.org/1999/02/22-rdf-syntax-ns#","rdfs":"http://www.w3.org/2000/01/rdf-schema#","ldp":"http://www.w3.org/ns/ldp#","foaf":"http://xmlns.com/foaf/0.1/","name":"rdfs:label","acl":"http://www.w3.org/ns/auth/acl#","permissions":"acl:accessControl","mode":"acl:mode","geo":"http://www.w3.org/2003/01/geo/wgs84_pos#","lat":"geo:lat","lng":"geo:long","inbox":"http://happy-dev.fr/owl/#inbox","object":"http://happy-dev.fr/owl/#object","author":"http://happy-dev.fr/owl/#author","account":"http://happy-dev.fr/owl/#account","jabberID":"foaf:jabberID","picture":"foaf:depiction"}}

Response:

{"detail":"You do not have permission to perform this action.","@context":"https://cdn.happy-dev.fr/owl/hdcontext.jsonld"}

The route /circles/2/, showing right permissions:

{"@id":"https://api.test2.startinblox.com/circles/2/","is_backlink":false,"allow_create_backlink":true,"name":"Private Circle","description":"On test 2","creationDate":"2020-05-22","status":"Private","jabberID":"bufzjspuzbst@conference.test2.startinblox.com","jabberRoom":true,"owner":{"@id":"https://api.test2.startinblox.com/users/jbpasquier/"},"team":{"@id":"https://api.test2.startinblox.com/circles/2/team/","@type":"ldp:Container","ldp:contains":[{"@id":"https://api.test2.startinblox.com/users/jbpasquier/"}],"permissions":[{"mode":{"@type":"add"}},{"mode":{"@type":"view"}}]},"members":{"@id":"https://api.test2.startinblox.com/circles/2/members/","@type":"ldp:Container","ldp:contains":[{"@id":"https://api.test2.startinblox.com/circle-members/2/"}],"permissions":[{"mode":{"@type":"add"}},{"mode":{"@type":"view"}}]},"@type":"hd:circle","permissions":[{"mode":{"@type":"view"}},{"mode":{"@type":"change"}},{"mode":{"@type":"delete"}}],"@context":"https://cdn.happy-dev.fr/owl/hdcontext.jsonld"}

The route /circles/2/members/, also seems to show the right permissions:

{"@id":"https://api.test2.startinblox.com/circles/2/members/","@type":"ldp:Container","ldp:contains":[{"@id":"https://api.test2.startinblox.com/circle-members/2/","is_backlink":false,"allow_create_backlink":true,"is_admin":true,"user":{"@id":"https://api.test2.startinblox.com/users/jbpasquier/"},"@type":"hd:circlemember","permissions":[{"mode":{"@type":"view"}}]}],"permissions":[{"mode":{"@type":"add"}},{"mode":{"@type":"view"}}],"@context":"https://cdn.happy-dev.fr/owl/hdcontext.jsonld"}

mentioned in issue applications/hubl#520 (closed)

changed title from 403 on adding distant user on a local circle to 403 on adding a user to a private circle

mentioned in merge request !130 (merged)

When testing I found that this affects adding local users to private circles, too. I updated the description

This is due to multiple bugs

The first culprit I found is Model.resolve_id

The line https://git.startinblox.com/djangoldp-packages/djangoldp/blob/bb53ba6daac520c8765cf3a0075c7a65b7ebd75d/djangoldp/models.py#L118

return view.initkwargs['model'].objects.get(**kwargs)

given the path /circles/1/members/ resolves the id 1 (of the parent circle), when it should resolve None (indicating this is a container)

While debugging I found a related bug: #245 (closed)

I've opened an MR and requested feedback on the solution for both here !130 (merged)

The second culprit is the permissions system

Here, has_permission tries to see if the path is a nested container. If it is it gives the user_permissions function the object and model of the parent container, not the CircleMember object

It causes complications when extending user_permissions, because it means that the programmer has to code their custom permissions class to handle many different and confusing cases:

• ModelBase of my actual model
• object instance of my actual model
• ModelBase and object instance of any possible parents I am a nested field of

I've opened an MR to get it working for Hubl in the short term (djangoldp-circle!22 (merged)), although the result of this is that it now doesn't work with the /circle-members/ url. I've also added a lot of unit tests to DjangoLDP-Circle

We use Django-Guardian to support object-level permissions. The long-term design (discussed here #197 (closed) ) is to use post_save signals to manage the object-level permissions assigned to the user. However this is also not fit for purpose:

• Giving the "add" permission to a CircleMember object has no effect. POST /circle-members/ or /circles/x/members/ are not calls to a CircleMember object
• Giving the "add" permission to the Circle would give the user permissions to add Circles, and to add any nested field to the circle. This might not seem like a problem with the members field, but perhaps a member should not gain access over a hypothetical projects nested field, for example
• Model-level permissions don't make sense either, I shouldn't now be able to add a CircleMember to any Circle I want

I'll link to this comment there to continue these discussions

give the user permissions to add Circles, and to add any nested field to the circle

And so, to any users which are members of the circle?

I don't think that it would give you permissions to add new users, but you could add a distant user as a new circle member

mentioned in issue #197 (closed)

closed

mentioned in issue applications/hubl#801 (moved)

mentioned in issue djangoldp-community#1 (closed)