search

Waziup / WaziCloud

WAZIUP Cloud and local platform
31 stars 28 forks source link

Permissions: Create a sensor already existing = 403 #235

Closed cdupont closed 3 years ago

cdupont commented 3 years ago

When I POST a sensor which is already existing, it returns 403. it should be 422. This is the logs from GW version 1:

2021-01-27T17:00:53.202285203Z Unable to push sensor.
2021-01-27T17:00:53.202397912Z Status: 403 Forbidden
2021-01-27T17:00:53.202507130Z Forbidden: Cannot access device Test. Cause: You are not admin, not owner of the device
2021-01-27T17:00:53.202617494Z [UP   ] Status /devices/Test/sensors/Test Value: create, error
2021-01-27T17:00:53.202762181Z [UP   ] Waiting 5s with REST before retry after error.
2021-01-27T17:00:58.203112391Z [UP   ] Pushing gateway "b827ebe7727d" to the cloud ...
2021-01-27T17:00:58.387432495Z [UP   ] Gateway already registered.
2021-01-27T17:00:59.870889817Z [UP   ] Status /devices/Test/sensors/Test Value: create
2021-01-27T17:01:00.397785716Z [UP   ] (200) Authentication successfull.
2021-01-27T17:01:00.588051170Z [UP   ] (403) Permission Error
2021-01-27T17:01:00.588536377Z Unable to push sensor.
2021-01-27T17:01:00.588617523Z Status: 403 Forbidden

This gateway was handed over from one owner to another. It tries to create a sensor on a device that was already created by the previous owner. It fails because it gets a 403 permission error (it was expecting 422 already exists).

cdupont commented 3 years ago

I would not change the behavior of the Cloud as it seems correct. POSTing a sensor is actually modifying a device, so if you don't have update access on that device, it should return 403. Probably the gateway should be updated to tolerate this.