Attributes modifiable_by role="maintainer" can't be modified in subprojects

[Vogtinator]

The requests triggered by OBS:AutoCleanup clearly state:

Such requests get not created for projects with open requests or if you remove the OBS:AutoCleanup attribute.

However, the OBS:AutoCleanup attribute can't be removed:

Sorry, you are not authorized to edit this Attrib.

[coolo]

'edit this Attrib.' as error is a bug report in itself :)

[adrianschroeter]

On Dienstag, 12. November 2019, 08:59:19 CET Fabian Vogt wrote: The requests triggered by `OBS:AutoCleanup` clearly state: > Such requests get not created for projects with open requests or if you > remove the OBS:AutoCleanup attribute. However, the `OBS:AutoCleanup` attribute can't be removed:

sure? Are you the maintainer? # eosc api /attribute/OBS/AutoCleanup/_meta <definition name="AutoCleanup" namespace="OBS"> <description>The object will recieve a delete request at specified time (YYYY-MM-DD HH:MM:SS) in the value</description> <count>1</count> <modifiable_by role="maintainer"/> </definition>

…

> Sorry, you are not authorized to edit this Attrib.

-- Adrian Schroeter <adrian@suse.de> Build Infrastructure Project Manager SUSE Software Solutions Germany GmbH, Maxfeldstr. 5, 90409 Nuernberg, Germany (HRB 247165, AG München), Geschäftsführer: Felix Imendörffer

[Vogtinator]

sure? Are you the maintainer?

I can edit the project meta, prjconf, etc. just fine, but I'm not set as maintainer in the project itself, only the parent project.

I'll add myself as maintainer and try again.

[Vogtinator]

I'll add myself as maintainer and try again.

That worked. So it's just inconsistent handling of permissions.

[coolo]

Just for the record: this is osc or webui?

[Vogtinator]

WebUI prints

Sorry, you are not authorized to edit this Attrib.

Using osc fails as well, with

b'<status code="change_attribute_no_permission">\n <summary>User favogt has no permission to change attribute</summary>\n</status>\n'

[dmarcoux]

For a reason I ignore, there is a custom permission handling for the attributes. Instead of only checking if a user can modify the project/package in which the attribute is (just like we do with the project/package's meta for example), we also have custom permission rules defined as AttribTypeModifiableBy.