Project (auto)create: Add Team to ACL for ApiKey principals - #1529
Conversation
Signed-off-by: Valentijn Scholten <valentijnscholten@gmail.com>
ad59583 to
913260c
Compare
|
Maybe we also have to add the |
Signed-off-by: Valentijn Scholten <valentijnscholten@gmail.com>
|
Updated |
valentijnscholten
changed the title
| */ | ||
| public boolean updateNewProjectACL(Project project, Principal principal) { | ||
| if (isEnabled(ConfigPropertyConstants.ACCESS_MANAGEMENT_ACL_ENABLED) && principal instanceof ApiKey) { | ||
| ApiKey apiKey = (ApiKey) principal; |
There was a problem hiding this comment.
Is this what we want to do? If I cloned a project, I would expect all users and teams that had access to the project would also have access to the new project. This method appears to only grant access to the API key that performed the cloning.
There was a problem hiding this comment.
This PR only covers creation of new projects. I was thinking about a separate PR for cloning, or do you prefer to have it combined here? It would add a field to the Clone Project request.
There was a problem hiding this comment.
Ah correct. Different things. A separate PR for the cloning would be good.
2 participants
Changes
When Project is autocreated during BOM upload and Portfolio Access Control is enabled, the ACL of the new Project should contain the Team that created the Project. fixes #1435
The same cannot yet be done for Users autocreating a Project as we don't know which Team should be added to the ACL. Users can be in 0 or more Teams.
Unit tests
I was planning on updating the unit tests to reflect this scenario. But there are no unit tests around Portfolio Access Control it seems. It would to be too big a change for me here to add them in this PR.
Notes
There already was some duplicate code in the
BomResource. I didn't want to refactor too much, but tried to avoid creating more duplicate code.