[tests-only][full-ci] adding test for listing permission of personal drive by a diffrent user

[nirajacharya2]

Description

this pr adds test for listing permission of personal space by a different user

added scenarios

Scenario: try to lists the permissions of a users personal space by a different member

Related Issue

• Related issues: [QA][Sharing Ng] Increase tests coverage for list permission #8336

Motivation and Context

How Has This Been Tested?

• test environment:
• locally
• ci

Screenshots (if appropriate):

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Technical debt
• Tests only (no source changes)

Checklist:

• Code changes
• Unit tests added
• Acceptance tests added
• Documentation ticket raised:

[saw-jan]

@nirajacharya2 You have conflicts, please, rebase the PR

[SagarGi]

should not it be a 403 status code? user accessing the another owned resource? just a guess.

[saw-jan]

IMO, 404 is good here. because no user with any role should not be able to stat/access other user's personal space

[phil-davis]

Yes, for this sort of access attempt 404 needs to be returned whenever the request tries to access a resource that it does not have permission to access.
Otherwise, if it did return 403 for a resource that exists but the user has no permission, and 404 for a resource that does not exist at all, then the user could try to guess lots of "random" resources, and would know that the ones that return 403 do actually exist. That would reveal something that the user should not be able to know (the guessed name of the resource...)

[sonarcloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarCloud