Repository: Kinto/kinto

Issue:
Memory backend sometimes show empty permissions
If you do multiple requests on memory backend, the empty permissions cycle between showing and not showing. The same does not happen with postgres.

```json
gsurita-30820:kinto gsurita$ echo '{"permissions": {"read": []}}' | http put localhost:8888/v1/buckets/b1 -a a:a

{
    "data": {
        "id": "b1",
        "last_modified": 1485553456205
    },
    "permissions": {
        "write": [
            "basicauth:80866b4d0726f35eda20b90bc479a38727c99c68d7c88a87f3b860726a79daeb"
        ]
    }
}

gsurita-30820:kinto gsurita$ echo '{"permissions": {"read": []}}' | http put localhost:8888/v1/buckets/b1 -a a:a

{
    "data": {
        "id": "b1",
        "last_modified": 1485553470501
    },
    "permissions": {
        "collection:create": [],
        "group:create": [],
        "read": [],
        "write": [
            "basicauth:80866b4d0726f35eda20b90bc479a38727c99c68d7c88a87f3b860726a79daeb"
        ]
    }
}

gsurita-30820:kinto gsurita$ echo '{"permissions": {"read": []}}' | http put localhost:8888/v1/buckets/b1 -a a:a

{
    "data": {
        "id": "b1",
        "last_modified": 1485553471419
    },
    "permissions": {
        "write": [
            "basicauth:80866b4d0726f35eda20b90bc479a38727c99c68d7c88a87f3b860726a79daeb"
        ]
    }
}

gsurita-30820:kinto gsurita$ echo '{"permissions": {"read": []}}' | http put localhost:8888/v1/buckets/b1 -a a:a

{
    "data": {
        "id": "b1",
        "last_modified": 1485553472203
    },
    "permissions": {
        "collection:create": [],
        "group:create": [],
        "read": [],
        "write": [
            "basicauth:80866b4d0726f35eda20b90bc479a38727c99c68d7c88a87f3b860726a79daeb"
        ]
    }
}



Discussion:

Resolving patch:
diff --git a/kinto/core/permission/memory.py b/kinto/core/permission/memory.py
--- a/kinto/core/permission/memory.py
+++ b/kinto/core/permission/memory.py
@@ -145,7 +145,7 @@ def replace_object_permissions(self, object_id, permissions):
             permission_key = 'permission:{}:{}'.format(object_id, permission)
             if permission_key in self._store and len(principals) == 0:
                 del self._store[permission_key]
-            else:
+            elif principals:
                 self._store[permission_key] = set(principals)
         return permissions
 


Test patch:
diff --git a/kinto/core/permission/testing.py b/kinto/core/permission/testing.py
--- a/kinto/core/permission/testing.py
+++ b/kinto/core/permission/testing.py
@@ -458,6 +458,13 @@ def test_replace_object_permission_supports_empty_list(self):
         permissions = self.permission.get_object_permissions('/url/a/id/1')
         self.assertEqual(len(permissions), 0)
 
+    def test_replace_object_permission_supports_empty_list_to_new_object(self):
+        self.permission.replace_object_permissions('/url/a/id/1', {
+            "write": set()
+        })
+        permissions = self.permission.get_object_permissions('/url/a/id/1')
+        self.assertEqual(len(permissions), 0)
+
     def test_delete_object_permissions_remove_all_given_objects_acls(self):
         self.permission.add_principal_to_ace('/url/a/id/1', 'write', 'user1')
         self.permission.add_principal_to_ace('/url/a/id/1', 'write', 'user2')