FR Home: unpublished remote form doesn't show in list

orbeon / orbeon-forms

Orbeon Forms is an open source web forms solution. It includes an XForms engine, the Form Builder web-based form editor, and the Form Runner runtime.

http://www.orbeon.com/

GNU Lesser General Public License v2.1

515 stars 221 forks source link

FR Home: unpublished remote form doesn't show in list #2275

Open ebruchez opened 9 years ago

ebruchez commented 9 years ago

push form local → remote
unpublish remote
refresh doesn't show remote form anymore

I think this might be a regression.

The service call to /fr/service/persistence/form on the remote server doesn't return the unpublished form.

ebruchez commented 9 years ago

checked that we put <available>false</available> in form as expected
logic in filterFormsAndAnnotateWithOperations: unavailable forms are only returned by the API if the user has admin rights
and in this case, form-builder-permissions.xml doesn't have <role name="*" app="*" form="*"/> or other
therefore the unavailable form is not shown

ebruchez commented 9 years ago

CONCLUSION: In order for this to work as expected, the user's local rights should match the user's remote rights for the service. This is a bit tricky:

local permissions are determined by
- the user's username/roles
- Form Builder permissions
remote permissions are determined by
- whether the authorization service accepts or rejects the request
- which username/roles are determined
- which can be container-based or header-based
- in practice, if the remote Form Runner allows pages access, must be via the headers-based method
- which means that this is broken if you want to set Form Builder permissions which are not just '*' for everybody
- Form Builder permissions

ebruchez commented 9 years ago

RESOLUTION: Authorizer must also provide username, group and roles. See #2321 for more.

ebruchez commented 8 years ago

Still the case as of 2016-04-18/2016.1.

ebruchez commented 2 years ago

With #2321, we have revised how to fix this. Instead, Orbeon-* authentication headers are passed directly to the service calls.

ebruchez commented 2 years ago

[ ] Form Runner admin page must pass Orbeon-* headers to remote endpoint
- [ ] in putWithAttachments for attachments
- [ ] in saveXmlData for XML data, which uses fr-create-update-submission
[ ] doc
[ ] test

ebruchez commented 2 years ago

Check which API requires user/roles: form metadata API?
Also use case: 2 departments, locally list only forms for that department, but must also do that on the remote server.