NXP-29759: Make the task endpoint use the UserManagerResolver

[charlesboidot]

Fix for NXP-29759: Make the task endpoint use the UserManagerResolver

[nuxeojenkins]

View issue in JIRA: NXP-29759: Make the task endpoint use the UserManagerResolver

[efge]

Adding this kind of method on public and important API like that is an architecture change that should be discussed first. Please open a discussion on Slack in #team-platform about this, because I'm really not sure it's the best way to move forward.

[efge]

Cc @nuxeo/platform

[efge]

Apart from the architecture aspects I mentioned above, I don't understand from the patch who is the intended user of the new "isComplete" that is being returned in the JSON. Is there an associated ticket on the UI side that shows the goal?

[efge]

If we want to add additional flags to the principal, then two things:

• I'd prefer if the flag was false by default on a complete instance, so named instead "isIncomplete" or "isPartial". But the doc and maybe the naming should be clear about in what way it's incomplete, what's the difference between a complete and incomplete instance?
• Setting the flag should be done at a lower level than in UserManagerResolver. It should probably be done in UserManagerImpl.makePrincipal when the caller (higher in the stack) has fetchReferences=false.

[troger]

I agree with @efge, nothing should be done in UserManagerResolver. What about removing the public API but just use a simple flag in the underlying DocumentModel through #putContextData?

Could be done in UserManagerImpl#getUserModel if fetchReferences is false, and then this flag will be read by the NuxeoPrincipalWriter to set accordingly the isPartial field?

[charlesboidot]

If we want to add additional flags to the principal, then two things:

* I'd prefer if the flag was false by default on a complete instance, so named instead "isIncomplete" or "isPartial". But the doc and maybe the naming should be clear about in what way it's incomplete, what's the difference between a complete and incomplete instance?

* Setting the flag should be done at a lower level than in `UserManagerResolver`. It should probably be done in `UserManagerImpl.makePrincipal` when the caller (higher in the stack) has `fetchReferences=false`.

The difference between a complete and a partial principal are that in the case where we don't want to fetch the references we can't tell the groups a principal is in and without the groups we can't determine if he is an Administrator. In this case we will have two incorrect entries for the principal: the groups will be empty and the isAdministrator value will be false, because without fetching the groups we have no way of knowing either one.

For the second issue it could be done even inside the getUserManager().getPrincipal() method if the fetchReferences boolean is false.