API: creating a new project returns "You cannot remove yourself as an owner." about oss-attribution-builder HOT 4 CLOSED

Correct. It's a map/object where the keys are group names (from getGroups), and values are one of owner, editor, and viewer.

from oss-attribution-builder.

The error you're seeing comes from some validation logic that attempts to ensure that a project isn't left in an unusable state. This error message is general, but also affects new projects (it could be better). Basically, it's telling you that with the permissions you've specified, the project you've created has permissions that prevent you from editing it.

How to fix this is going to depend on the authorization backend you're using. The only one we ship in this project is nullauth, which is set up as a demonstration. This has a couple properties: 1) you're in a group called self:yourusername, and 2) everyone is in a group called everyone (you can see that at the bottom of the file linked).

If you wanted to replicate that (before implementing authorization), you'd want to set a key of self:username to owner, replacing the username with whatever user you're supplying for authentication. But you'll want to replace that authorization backend with something more geared for production use. :)

At Amazon we have a custom back-end set up to work with our internal SSO and LDAP systems. i.e., getGroups will query our directory for groups that the viewing user is a member of. Here's a small snippet of that:

  async getGroups(user: string): Promise<string[]> {
    const ldapGroups = await this._ldapsearch('ou=groups,o=.....', {
      scope: 'sub',
      filter: 'memberuid=' + encodeURIComponent(user),
      attributes: ['cn'],
    }, (obj) => `ldap:${obj.cn}`);
...
    return ldapGroups;
  }

Bit more to it than just that, but that's the general idea. The groups you supply in the ACL structure (when creating or modifying a project) have to have at least one with a value of owner and a key that is the output of getGroups. In other words, the key has to be one of the current user's groups.

Does that help answer your question?

from oss-attribution-builder.

Chiming in here, when looking at

and

I also found it hard to understand that ACL is not actually a single string / enum, but a (hash)map (I guess that's what JavaScript generically calls an "object") of (authentication backend specific) strings to permissions, where permissions can be one of "owner", "editor" or "viewer". Correct?

from oss-attribution-builder.

#44

from oss-attribution-builder.