Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Admin need permission to delete orphaned project spaces #4196

Closed
ScharfViktor opened this issue Jul 13, 2022 · 3 comments · Fixed by #4530
Closed

Admin need permission to delete orphaned project spaces #4196

ScharfViktor opened this issue Jul 13, 2022 · 3 comments · Fixed by #4530
Assignees
@rhafer
Labels
Category:Enhancement Add new functionality Priority:p2-high Escalation, on top of current planning, release blocker
Milestone
2.0.0 General Ava...

Comments

@ScharfViktor
Copy link
Contributor

2.0.0-beta.5

Steps:

  • user Katherine creates project space (without manager members)
  • admin deletes Katherine

Expected: admin must be able to manage the space. Share space between users or delete space
Actual: admin cannot manage orphaned project spaces
@ScharfViktor ScharfViktor mentioned this issue Jul 13, 2022
Closed
@micbar micbar added Category:Enhancement Add new functionality and removed Type:Bug labels Jul 13, 2022
@micbar
Copy link
Contributor

micbar commented Jul 13, 2022

We should add a permission
"can edit all spaces" (memberships)
"can delete all spaces"

And assign them to the "admin" Role

@micbar micbar added the Priority:p2-high Escalation, on top of current planning, release blocker label Jul 13, 2022
@micbar micbar added this to the 2.0.0 General Availability milestone Jul 13, 2022
@micbar micbar mentioned this issue Jul 13, 2022
Closed
@ScharfViktor ScharfViktor mentioned this issue Aug 22, 2022
Closed
@rhafer rhafer self-assigned this Aug 29, 2022
@rhafer
Copy link
Contributor

rhafer commented Aug 31, 2022

We should add a permission "can edit all spaces" (memberships) "can delete all spaces"

Should that new permission really apply all spaces? Or should it only apply to just spaces of type "project"? I am asking because in #4447 we're adding a new permission "delete-all-home-spaces". So I guess it would make sense to either have "delete-all-home-spaces" and "delete-all-project-spaces" as sepearte permission. Or just introduce a single new "delete-all-spaces" permission that allow to delete spaces of any type.
@micbar which option would you prefer?

@micbar
Copy link
Contributor

micbar commented Sep 6, 2022

delete-all-project-spaces is a bit problematic IMO because this is based on the assumption that we have spaces of this type. Makes it hard to work with arbitrary space types. So i would prefer delete-all-spaces

rhafer added a commit to rhafer/ocis that referenced this issue Sep 7, 2022
@rhafer
Add new "delete-all-spaces" permission
a9a39b4 
This is assigned to the Admin role by default and allows to cleanup
orphaned spaces (e.g. where the owner as been deleted)

Fixes: owncloud#4196
@rhafer rhafer mentioned this issue Sep 7, 2022
Merged
rhafer added a commit to rhafer/ocis that referenced this issue Sep 7, 2022
@rhafer
Add new "delete-all-spaces" permission
fd807ba 
This is assigned to the Admin role by default and allows to cleanup
orphaned spaces (e.g. where the owner as been deleted)

Fixes: owncloud#4196
rhafer added a commit that referenced this issue Sep 7, 2022
@rhafer
Add new "delete-all-spaces" permission
e5543d4 
This is assigned to the Admin role by default and allows to cleanup
orphaned spaces (e.g. where the owner as been deleted)

Fixes: #4196
ownclouders pushed a commit that referenced this issue Sep 7, 2022
@rhafer
commit e5543d4
09967de 
Author: Ralf Haferkamp <[email protected]>
Date:   Wed Sep 7 16:41:02 2022 +0200

    Add new "delete-all-spaces" permission

    This is assigned to the Admin role by default and allows to cleanup
    orphaned spaces (e.g. where the owner as been deleted)

    Fixes: #4196
butonic added a commit that referenced this issue Sep 8, 2022
@kobergj @aduffeck
@butonic @dragonchaser @dependabot @ScharfViktor @SagarGi @rhafer @SwikritiT @JammingBen @phil-davis @amrita-shrestha @micbar
[tests-only][full-ci] Merge master into experimental (#4541)
21c55ed 
* Add support for the jsoncs3 share manager

* WIP: point to the wip-reva with the jsoncs3 share manager

* migration fixes

Signed-off-by: Jörn Friedrich Dreyer <[email protected]>

* update reva

Signed-off-by: Jörn Friedrich Dreyer <[email protected]>

* use common config for jsoncs3 defaults

Signed-off-by: Jörn Friedrich Dreyer <[email protected]>

* lint

Signed-off-by: Jörn Friedrich Dreyer <[email protected]>

* add home space deletion on user delete

Signed-off-by: Christian Richter <[email protected]>

* update reva

Signed-off-by: Jörn Friedrich Dreyer <[email protected]>

* add delete home space permission to admin role

Signed-off-by: Christian Richter <[email protected]>

* Bump github.com/tus/tusd from 1.9.0 to 1.9.1

Bumps [github.com/tus/tusd](https://github.com/tus/tusd) from 1.9.0 to 1.9.1.
- [Release notes](https://github.com/tus/tusd/releases)
- [Commits](tus/tusd@v1.9.0...v1.9.1)

---
updated-dependencies:
- dependency-name: github.com/tus/tusd
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>

* Bump github.com/onsi/gomega from 1.20.0 to 1.20.1

Bumps [github.com/onsi/gomega](https://github.com/onsi/gomega) from 1.20.0 to 1.20.1.
- [Release notes](https://github.com/onsi/gomega/releases)
- [Changelog](https://github.com/onsi/gomega/blob/master/CHANGELOG.md)
- [Commits](onsi/gomega@v1.20.0...v1.20.1)

---
updated-dependencies:
- dependency-name: github.com/onsi/gomega
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>

* part1

* update reva

Signed-off-by: Jörn Friedrich Dreyer <[email protected]>

* [test-only] apiTest. change own password (#4480)

* apiTest. change own password

* fix

* Bump github.com/gookit/config/v2 from 2.1.2 to 2.1.4

Bumps [github.com/gookit/config/v2](https://github.com/gookit/config) from 2.1.2 to 2.1.4.
- [Release notes](https://github.com/gookit/config/releases)
- [Commits](gookit/config@v2.1.2...v2.1.4)

---
updated-dependencies:
- dependency-name: github.com/gookit/config/v2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>

* move graph api methods from Space context to GraphHelper

* fix after rebase

* Bump github.com/rs/zerolog from 1.27.0 to 1.28.0

Bumps [github.com/rs/zerolog](https://github.com/rs/zerolog) from 1.27.0 to 1.28.0.
- [Release notes](https://github.com/rs/zerolog/releases)
- [Commits](rs/zerolog@v1.27.0...v1.28.0)

---
updated-dependencies:
- dependency-name: github.com/rs/zerolog
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>

* Bump github.com/onsi/ginkgo/v2 from 2.1.4 to 2.1.6

Bumps [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) from 2.1.4 to 2.1.6.
- [Release notes](https://github.com/onsi/ginkgo/releases)
- [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md)
- [Commits](onsi/ginkgo@v2.1.4...v2.1.6)

---
updated-dependencies:
- dependency-name: github.com/onsi/ginkgo/v2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>

* Bump github.com/coreos/go-oidc/v3 from 3.2.0 to 3.3.0

Bumps [github.com/coreos/go-oidc/v3](https://github.com/coreos/go-oidc) from 3.2.0 to 3.3.0.
- [Release notes](https://github.com/coreos/go-oidc/releases)
- [Commits](coreos/go-oidc@v3.2.0...v3.3.0)

---
updated-dependencies:
- dependency-name: github.com/coreos/go-oidc/v3
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>

* Added /Shares related tests for lock properties on ocis

* Update expected to failure for local api for copy

* Bump github.com/grpc-ecosystem/grpc-gateway/v2 from 2.11.2 to 2.11.3

Bumps [github.com/grpc-ecosystem/grpc-gateway/v2](https://github.com/grpc-ecosystem/grpc-gateway) from 2.11.2 to 2.11.3.
- [Release notes](https://github.com/grpc-ecosystem/grpc-gateway/releases)
- [Changelog](https://github.com/grpc-ecosystem/grpc-gateway/blob/master/.goreleaser.yml)
- [Commits](grpc-ecosystem/grpc-gateway@v2.11.2...v2.11.3)

---
updated-dependencies:
- dependency-name: github.com/grpc-ecosystem/grpc-gateway/v2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>

* refactor proxy code

I refactored the proxy so that we execute the routing before the
authentication middleware. This is necessary so that we can determine
which routes are considered unprotected i.e. which routes don't need
authentication.

* add unprotected flag to the proxy routes

I added an unprotected flag to the proxy routes which is evaluated by
the authentication middleware. This way we won't have to maintain a
hardcoded list of unprotected paths and path prefixes and we will
hopefully reduce the times we encounter the basic auth prompt by web
browsers.

* add missing unprotected flag and fix proxy test

* fix linting issues

* fix default policy and add changelog

* update tests

* Automated changelog update [skip ci]

* Bump google.golang.org/grpc from 1.48.0 to 1.49.0

Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.48.0 to 1.49.0.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.48.0...v1.49.0)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>

* Bump github.com/onsi/gomega from 1.20.1 to 1.20.2

Bumps [github.com/onsi/gomega](https://github.com/onsi/gomega) from 1.20.1 to 1.20.2.
- [Release notes](https://github.com/onsi/gomega/releases)
- [Changelog](https://github.com/onsi/gomega/blob/master/CHANGELOG.md)
- [Commits](onsi/gomega@v1.20.1...v1.20.2)

---
updated-dependencies:
- dependency-name: github.com/onsi/gomega
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>

* Bump github.com/urfave/cli/v2 from 2.11.2 to 2.14.0

Bumps [github.com/urfave/cli/v2](https://github.com/urfave/cli) from 2.11.2 to 2.14.0.
- [Release notes](https://github.com/urfave/cli/releases)
- [Changelog](https://github.com/urfave/cli/blob/main/docs/CHANGELOG.md)
- [Commits](urfave/cli@v2.11.2...v2.14.0)

---
updated-dependencies:
- dependency-name: github.com/urfave/cli/v2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>

* Bump github.com/owncloud/libre-graph-api-go from 0.16.0 to 0.17.0

Bumps [github.com/owncloud/libre-graph-api-go](https://github.com/owncloud/libre-graph-api-go) from 0.16.0 to 0.17.0.
- [Release notes](https://github.com/owncloud/libre-graph-api-go/releases)
- [Commits](owncloud/libre-graph-api-go@v0.16.0...v0.17.0)

---
updated-dependencies:
- dependency-name: github.com/owncloud/libre-graph-api-go
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>

* Evaluate routing rules ordered by path-length

This is a quickfix for #4497. Before evaluating, we now sort the rules
of a specific type by the length of the endpoints and start evaluation
with the most specific endpoint first. There's obviously quite a bit
room for optimization here and this will only fix the issue for routes
of type `PrefixRoute`. But it should solve the immediate issue.

* Bump commit id for tests

* Improve login screen design

* Move background-size after the background css prop

* add returns after rendering errors and simplify loop condition

* Hardcode header in GraphHelper::deleteSpace

* Add 'Inter' font, change placeholder color to grey

* Use cv11 as font feature setting

* Automated changelog update [skip ci]

* adjust REPORT to PROPFIND endpoint

Signed-off-by: jkoberg <[email protected]>

* regenerate protogen

Signed-off-by: jkoberg <[email protected]>

* adjust expected failures

Signed-off-by: jkoberg <[email protected]>

* Automated changelog update [skip ci]

* Fix translations on login page

* Automated changelog update [skip ci]

* removed search test from expected failures

* Reuse code of code from core at most

* Add commit and branch related to this PR to work

* Reuse locking method from core

* fix search test

* Add api tests for tus upload when quota is set

* Add tests removed by core pr-40276

* graph: Fix Status code when updating the password

Up to now the /me/changePassword endpoint return a 500 Status when
issue a password change with the old password set to the wrong password.
This changes the code to return 400 (Bad Request) with an additional
message that the old password is wrong. This does not seem to weaken the
security of /me/changePassword (i.e. for allowing easier brute-force
attacks) as the endpoint is only available to already authenticated
users (and only for changing their own passwords)

See #4480

* Bump github.com/gookit/config/v2 from 2.1.4 to 2.1.5

Bumps [github.com/gookit/config/v2](https://github.com/gookit/config) from 2.1.4 to 2.1.5.
- [Release notes](https://github.com/gookit/config/releases)
- [Commits](gookit/config@v2.1.4...v2.1.5)

---
updated-dependencies:
- dependency-name: github.com/gookit/config/v2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>

* auto orientate pictures for thumbnails

* Automated changelog update [skip ci]

* update buf lock

* graph: purge home space when deleting a user

previously the homespace was just marked as trashed

Fixes: #4195

* proxy: Initialize logger for router

* proxy: Fix archiver for public links

Allows /archiver to be used the "public-token" auth middleware. The
archiver is a bit of a special case, because it can be uses in several
ways: using 'normal' authentication (basic, oidc), using signed-urls or
using sharetokens. As only the "sharetoken" part is handled by the
"PublicShareAuth" middleware, we needed to special-case it a bit.

* proxy: Clarify comment

* proxy: Avoid sorting endpoints for every single request

The endpoints are no longer hashed by path name in the directors map since
that made iterating over the endpoints unstable. They are now stored in a
slice in the order in which the are defined in the configuration.

Closes: #4497

* Automated changelog update [skip ci]

* update reva to latest edge

* remove personal spaces as admin in the graph test suite

* use id to delete project spaces

* Add context in behat.yml

* Fix home space deletion when deleting user by name

DELETE requess on /graph/v1.0/users also work when specifing a user by
name. For deleting the home space in that case we need to get the User's
id from the backend first.

Fixes: #4195

* Add new "delete-all-spaces" permission

This is assigned to the Admin role by default and allows to cleanup
orphaned spaces (e.g. where the owner as been deleted)

Fixes: #4196

* Automated changelog update [skip ci]

* Automated changelog update [skip ci]

* update reva to latest edge

* Automated changelog update [skip ci]

* delete users with their personal spaces

* update reva to latest edge

* delete method

* Remove tests from unrelated issue and add actual one

* REPORT: add permissions to personal space

Signed-off-by: jkoberg <[email protected]>

* changelog and bump reva

Signed-off-by: jkoberg <[email protected]>

* Automated changelog update [skip ci]

* update reva and jsoncs3 share manager config

* use experimental reva

Signed-off-by: jkoberg <[email protected]>

* fix search service after merge

Signed-off-by: jkoberg <[email protected]>

* praise the linting god

Signed-off-by: jkoberg <[email protected]>

* use cs3 share manager

Signed-off-by: jkoberg <[email protected]>

Signed-off-by: Jörn Friedrich Dreyer <[email protected]>
Signed-off-by: Christian Richter <[email protected]>
Signed-off-by: dependabot[bot] <[email protected]>
Signed-off-by: jkoberg <[email protected]>
Co-authored-by: André Duffeck <[email protected]>
Co-authored-by: Jörn Friedrich Dreyer <[email protected]>
Co-authored-by: Christian Richter <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Viktor Scharf <[email protected]>
Co-authored-by: David Christofas <[email protected]>
Co-authored-by: [email protected] <[email protected]>
Co-authored-by: Ralf Haferkamp <[email protected]>
Co-authored-by: Swikriti Tripathi <[email protected]>
Co-authored-by: Jannik Stehle <[email protected]>
Co-authored-by: Phil Davis <[email protected]>
Co-authored-by: Swikriti Tripathi <[email protected]>
Co-authored-by: Jannik Stehle <[email protected]>
Co-authored-by: Sagar Gurung <[email protected]>
Co-authored-by: Amrita <[email protected]>
Co-authored-by: Michael Barz <[email protected]>
Co-authored-by: amrita <[email protected]>
@micbar micbar mentioned this issue Sep 12, 2022
Closed
29 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@rhafer rhafer

Labels
Category:Enhancement Add new functionality Priority:p2-high Escalation, on top of current planning, release blocker
Projects
Infinite Scale Team Board
Archived in project
Milestone
2.0.0 General Availability
Development

Successfully merging a pull request may close this issue.

Add new "delete-all-spaces" permission rhafer/ocis
3 participants
@rhafer @micbar @ScharfViktor