Permissions for groups can not be revoked w/o complete reset

[temparus]

Original permission of a given group

"permissions": {
        "users": "readwrite",
        "sessions": "readwrite",
        "events": "readwrite",
        "eventsignups": "readwrite"
}

The PATCH request to change a group's permissions with

"permissions": {
        "users": "readwrite",
        "sessions": "read",
        "studydocuments": "readwrite"
}

results in

"permissions": {
        "users": "readwrite",
        "sessions": "read",
        "events": "readwrite",
        "eventsignups": "readwrite",
        "studydocuments": "readwrite"
}

In order to revoke any permissions completely for a given group, first we have to patch the permissions field with null before we can patch the resource with the desired permissions.

[hermannsblum]

As we found out, this is the intended behaviour in eve

A possible solution would be to change the type for permissions from dict to list

This would then look like this:

'permissions': {
            'type': 'list',
            'schema': {
                 'type': 'dict',
                 'schema': {
                       'resource':  {'type': 'string', 'api_resources': True},
                        'permission': {'type': 'string',
                                          'allowed': ['read', 'readwrite']},
                 },
             },
            'nullable': True,
}

[NotSpecial]

I think the behavior of eve is really weird in this case, it's a bit inconsistent. Maybe we should submit a pull request to allow disabling this behavior in the config.

[hermannsblum]

If you look at the response from nicolai to the issue, I don't see much hope for this to be patched in eve, his philosophy seems to be that overwrites should use PUT.

[NotSpecial]

I have created a pull request, lets see what the response will be!

pyeve/eve#1140

[NotSpecial]

My pull request has been accepted. In the next release of Eve (0.8), we'll be able to disable this behavior in Eve.

[cburchert]

Eve 0.8 was released, that did not take long :)

…

On Mon, May 7, 2018, 09:43 Alexander Dietmüller ***@***.***> wrote: My pull request has been accepted. In the next release of Eve (0.8), we'll be able to disable this behavior in Eve. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#267 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ACsKUlf2hvIvNa2q7S9SkLIfKRBMoVYhks5tv_s8gaJpZM4TyqtN> .