-
Notifications
You must be signed in to change notification settings - Fork 42
MMT-4080: As a MMT user, if I remove all selected collections and save, it should not default to all collections. #1408
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
…e, it should not default to all collections.
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #1408 +/- ##
==========================================
- Coverage 97.99% 97.96% -0.04%
==========================================
Files 421 421
Lines 6737 6780 +43
Branches 1403 1430 +27
==========================================
+ Hits 6602 6642 +40
- Misses 134 137 +3
Partials 1 1 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
|
Putting comments on slack here for posterity: I do see the error has gone away but the underlying issue seems to still be present (it's defaulting to all collections for me). Few things I was thinking about while testing this though:
|
Overview
What is the feature?
When a user removes all collections from their selected collection list, it should not default to all collections, but [] collections.
What is the Solution?
Fixed a bug where removing collections would inadvertently delete the entire collection_identifier block due to the code calling removeEmpty(). This caused ACLs to interpret the absence of collection_identifier as no filtering, exposing all collections instead of applying intended restrictions of [] no collections. The fix ensures that the collection_identifier block is preserved even when all specific collections are deselected, maintaining proper access controls and preventing unintended exposure of collections.
What areas of the application does this impact?
Collection Permissions
Testing
You can see the bug in UAT, try going to:
https://mmt.uat.earthdata.nasa.gov/permissions/ACL1276516601-CMR/edit
Add a couple collections and click submit,.
Take a look at the raw ACL:
curl -H "Authorization: $TOKEN" "https://cmr.uat.earthdata.nasa.gov:443/access-control/acls/ACL1276516601-CMR?pretty=true"
Now go back to: https://mmt.uat.earthdata.nasa.gov/permissions/ACL1276516601-CMR/edit
Remove those collections
And click submit.
curl -H "Authorization: $TOKEN" "https://cmr.uat.earthdata.nasa.gov:443/access-control/acls/ACL1276516601-CMR?pretty=true"
Notice that the entire collection identifier block was removed. This caused ACLs to interpret the absence of collection_identifier as no filtering, exposing all collections instead of applying intended restrictions of [] no collections.
https://mmt.uat.earthdata.nasa.gov/permissions/ACL1276516601-CMR/edit will show all collections checked.
Now try the same thing with this branch and you should see collection_identifier preserved.
Attachments
Please include relevant screenshots or files that would be helpful in reviewing and verifying this change.
Checklist