search

blackducksoftware / hub-rest-api-python

HUB REST API Python bindings
Apache License 2.0
89 stars 104 forks source link

403 on function assign_user_group_to_project() #189

Open Coulicoula opened 3 years ago

Coulicoula commented 3 years ago

Hi Black Duck Team

When using the assign_user_group_to_project() function, a user [with Project Manager rights - i.e default role as project creator] cannot add groups with roles within its own project. The reason why is because, you are not using the same endpoint when project roles have to be assigned or not:

  1. If you do not provide roles to the function assign_user_group_to_project(), you use the projects endpoint (https://SERVER/api/projects/PROJECT_HASH/roles)

    It will work in any case because project creator try to access is own project. OK.

  2. However, if you provide roles (a role list or whatever), you use the usergroups endpoint (https://SERVER/api/usergroups/USERGROUP_HASH/roles)

    It will not work if the user don't have the global role to access the usergroups endpoint. NOK

    If the user don't have enough privileges, he will not be able to access this group endpoint, and the function return a 403 error, due to insufficient privileges.

I'm attaching to this issue a PR. My proposal is to use in both cases the projects endpoint as it seems more natural in that situation. Also, I've modified a json parameter that seemed to be outdated. Regards, Nicolas