No enough permissions to update Instance Relationships
Description
CSP Request Details
CSP Rejection Details
Potential Workaround
Checklist
hideTestRail: Results
Activity
Bohdan SuprunJanuary 28, 2020 at 12:30 PM
Hi @Igor Gorchakov,
Due to the luck of response I'm closing the issue as can not reproduce.
If the issue is still reproducible please raise/reopen a bug and provide steps how to reproduce it.
CC: @Cate Boerema, @Oleksiy_Lemeshko.
Thanks,
Bohdan
Bohdan SuprunJanuary 27, 2020 at 4:34 PM
Hi @Igor Gorchakov, @Marc Johnson,
Why do we need to update/remove relationships in POST instance endpoint? My understanding that when we create an instance the instance relationships should not exists, so no need to update/remove them but only to create, unless you're running a special case, e.g. upsert.
Could you please provide some steps to reproduce?
Thanks,
Bohdan
Marc JohnsonJanuary 10, 2020 at 3:04 PM
@Cate Boerema I think this is either a P2 or a P3.
When I went through the backend bugs assigned to the Core Functional team recently, I concluded this was a P3.
This was based upon
The product or application doesn’t meet certain criteria or still exhibits some unnatural behavior while affecting one isolated piece of functionality.
The unmet criteria is that the inventory API should be accessible to users with the minimum amount of permissions for that API.
An issue is self-contained and has an acceptable & easily reproducible workaround.
The missing permissions can be added to the UI defined permission set. I don't know if this workaround has already been applied.
Cate BoeremaJanuary 10, 2020 at 2:37 PM
@Marc Johnson can you please assign the appropriate priority to this? I am not sure how to assess it.
Charlotte WhittJanuary 5, 2020 at 6:38 PM
Hi @Marc Johnson - I just noticed that you changed this to a P2.
Please note that the UI work is not yet done, and the work has not being prioritized for cap-MVP.
We can maybe talk next week about this, if you think this should be re-prioritized/change somehow.
NOTE: No need to do this until Instance relationship feature is completed in the UI (see UIIN-231)
Prerequisites
POST/instances method works with relationships while processing the target Instance (see Instances.updateInstanceRelationships method )
While working with Instance relationships the mod-inventory may do GET, POST, PUT and DELETE requests, however POST endpoint does not have module permissions for PUT and DELETE operations.
Solution
Endpoint declaration(POST) should be expanded with 2 module permissions:
"inventory-storage.instances.item.put"
"inventory-storage.instances.item.delete"