Repository: Kinto/kinto

Issue:
Bug when giving write or create permission to system.Everyone
Giving a write or create permission to system.Everyone should create object with write: system.Everyone permission instead of None

```
$ echo '{"permissions": {"collection:create": ["system.Everyone"]}}' | http PUT https://kinto.dev.mozaws.net/v1/buckets/toto --auth demo:
$ http PUT https://kinto.dev.mozaws.net/v1/buckets/toto/collections/titi
```

```
HTTP/1.1 201 Created
Access-Control-Expose-Headers: Retry-After, Content-Length, Alert, Vary, Backoff
Connection: keep-alive
Content-Length: 97
Content-Type: application/json; charset=UTF-8
Date: Tue, 24 May 2016 12:32:40 GMT
ETag: "1464093160673"
Last-Modified: Tue, 24 May 2016 12:32:40 GMT
Server: nginx
Vary: Authorization

{
    "data": {
        "id": "titi", 
        "last_modified": 1464093160673, 
        "schema": {}
    }, 
    "permissions": {
        "write": [
            "None"
        ]
    }
}
```



Discussion:
~~Did not~~ COULD reproduce with current master and memory backend:

```
echo '{"permissions": {"collection:create": ["system.Everyone"]}}' | http PUT :8888/v1/buckets/toto --auth demo:
HTTP/1.1 201 Created
Access-Control-Expose-Headers: Retry-After, Content-Length, Alert, Vary, Backoff
Content-Length: 223
Content-Type: application/json; charset=UTF-8
Date: Tue, 24 May 2016 12:55:57 GMT
Etag: "1464094557039"
Last-Modified: Tue, 24 May 2016 12:55:57 GMT
Server: waitress
Vary: Authorization

{
    "data": {
        "id": "toto", 
        "last_modified": 1464094557039
    }, 
    "permissions": {
        "collection:create": [
            "system.Everyone"
        ], 
        "group:create": [], 
        "read": [], 
        "write": [
            "basicauth:0dee39e8946c74dd57d7e63987200f62365d7b96a5974e5f5f2dd68ec78af599"
        ]
    }
}
```

```
http PUT :8888/v1/buckets/titi/collections/titi
HTTP/1.1 201 Created
Access-Control-Expose-Headers: Retry-After, Content-Length, Alert, Vary, Backoff
Content-Length: 95
Content-Type: application/json; charset=UTF-8
Date: Tue, 24 May 2016 12:58:44 GMT
Etag: "1464094724551"
Last-Modified: Tue, 24 May 2016 12:58:44 GMT
Server: waitress
Vary: Authorization

{
    "data": {
        "id": "titi", 
        "last_modified": 1464094724551, 
        "schema": {}
    }, 
    "permissions": {
        "write": [
            null
        ]
    }
}
```


Resolving patch:
diff --git a/kinto/core/resource/__init__.py b/kinto/core/resource/__init__.py
--- a/kinto/core/resource/__init__.py
+++ b/kinto/core/resource/__init__.py
@@ -7,6 +7,7 @@
 import six
 from pyramid import exceptions as pyramid_exceptions
 from pyramid.decorator import reify
+from pyramid.security import Everyone
 from pyramid.httpexceptions import (HTTPNotModified, HTTPPreconditionFailed,
                                     HTTPNotFound, HTTPConflict,
                                     HTTPServiceUnavailable)
@@ -1105,7 +1106,12 @@ def __init__(self, *args, **kwargs):
 
         # Required by the ShareableModel class.
         self.model.permission = self.request.registry.permission
-        self.model.current_principal = self.request.prefixed_userid
+        if self.request.prefixed_userid is None:
+            # The principal of an anonymous is system.Everyone
+            self.model.current_principal = Everyone
+        else:
+            self.model.current_principal = self.request.prefixed_userid
+
         if self.context:
             self.model.get_permission_object_id = functools.partial(
                 self.context.get_permission_object_id,


Test patch:
diff --git a/kinto/tests/core/resource/test_object_permissions.py b/kinto/tests/core/resource/test_object_permissions.py
--- a/kinto/tests/core/resource/test_object_permissions.py
+++ b/kinto/tests/core/resource/test_object_permissions.py
@@ -95,6 +95,18 @@ def test_write_permission_is_given_to_put(self):
         permissions = result['permissions']
         self.assertEqual(sorted(permissions['write']), ['basicauth:userid'])
 
+    def test_write_permission_is_given_to_anonymous(self):
+        request = self.get_request()
+        # Simulate an anonymous PUT
+        request.method = 'PUT'
+        request.validated = {'data': self.record}
+        request.prefixed_userid = None
+        request.matchdict = {'id': self.record['id']}
+        resource = self.resource_class(request=request,
+                                       context=self.get_context())
+        result = resource.put()
+        self.assertIn('system.Everyone', result['permissions']['write'])
+
     def test_permissions_can_be_specified_in_collection_post(self):
         perms = {'write': ['jean-louis']}
         self.resource.request.method = 'POST'