Repository: Kinto/kinto

Issue:
Adding system.Authenticated to a group does not make any user belong to it
- Create a group with `"members": ["system.Authenticated"]`
- Add `write` perm to object for `/buckets/test/group/friends`
- Any authenticated user should be allowed to write

Adding system.Authenticated to a group does not make any user belong to it
- Create a group with `"members": ["system.Authenticated"]`
- Add `write` perm to object for `/buckets/test/group/friends`
- Any authenticated user should be allowed to write



Discussion:
I am not  sure it is a bug rather than a feature. We were considering `system.Authenticated` to be a group in itselve and you cannot add a group to a group.

As far as I remember, we are just checking that the `user_id` is in the group not that the group matches the user principal.

We might want to raise a 400 when it's put in the members of a group then.

We might, but we need to be able to detect that the principal we've got is not the user_id.
One way to do so is to check that a `:` is present in the member we add.

But maybe system.Authenticated and system.Everyone should be acceptable because they act as wildcard userid

Refs #794 

This bug is still valid as far as I understand, as #794 only applies to group URLs and system.Everyone

I am not  sure it is a bug rather than a feature. We were considering `system.Authenticated` to be a group in itselve and you cannot add a group to a group.

As far as I remember, we are just checking that the `user_id` is in the group not that the group matches the user principal.

We might want to raise a 400 when it's put in the members of a group then.

We might, but we need to be able to detect that the principal we've got is not the user_id.
One way to do so is to check that a `:` is present in the member we add.

But maybe system.Authenticated and system.Everyone should be acceptable because they act as wildcard userid

Refs #794 

This bug is still valid as far as I understand, as #794 only applies to group URLs and system.Everyone


Resolving patch:
diff --git a/kinto/core/permission/memory.py b/kinto/core/permission/memory.py
--- a/kinto/core/permission/memory.py
+++ b/kinto/core/permission/memory.py
@@ -56,9 +56,12 @@ def remove_principal(self, principal):
 
     @synchronized
     def get_user_principals(self, user_id):
+        # Fetch the groups the user is in.
         user_key = 'user:%s' % user_id
         members = self._store.get(user_key, set())
-        return members
+        # Fetch the groups system.Authenticated is in.
+        group_authenticated = self._store.get('user:system.Authenticated', set())
+        return members | group_authenticated
 
     @synchronized
     def add_principal_to_ace(self, object_id, permission, principal):
diff --git a/kinto/core/permission/postgresql/__init__.py b/kinto/core/permission/postgresql/__init__.py
--- a/kinto/core/permission/postgresql/__init__.py
+++ b/kinto/core/permission/postgresql/__init__.py
@@ -135,7 +135,8 @@ def get_user_principals(self, user_id):
         query = """
         SELECT principal
           FROM user_principals
-         WHERE user_id = :user_id;"""
+         WHERE user_id = :user_id
+            OR user_id = 'system.Authenticated';"""
         with self.client.connect(readonly=True) as conn:
             result = conn.execute(query, dict(user_id=user_id))
             results = result.fetchall()


Test patch:
diff --git a/kinto/core/permission/testing.py b/kinto/core/permission/testing.py
--- a/kinto/core/permission/testing.py
+++ b/kinto/core/permission/testing.py
@@ -140,6 +140,13 @@ def test_can_remove_principal_from_every_users(self):
         retrieved = self.permission.get_user_principals(user_id2)
         self.assertEquals(retrieved, {principal2})
 
+    def test_authenticated_is_returned_for_everybody(self):
+        user_id = 'foo'
+        principal = 'bar'
+        self.permission.add_user_principal('system.Authenticated', principal)
+        retrieved = self.permission.get_user_principals(user_id)
+        self.assertEquals(retrieved, {principal})
+
     #
     # get_object_permission_principals()
     #
diff --git a/tests/test_views_groups.py b/tests/test_views_groups.py
--- a/tests/test_views_groups.py
+++ b/tests/test_views_groups.py
@@ -173,6 +173,13 @@ def test_group_member_removal_updates_user_principals(self):
         self.assertEquals(self.permission.get_user_principals('mat'),
                           {group_url})
 
+    def test_group_with_authenticated_is_added_to_everbody(self):
+        self.create_group('beers', 'reviewers', ['system.Authenticated'])
+        self.assertEquals(self.permission.get_user_principals('natim'),
+                          {'/buckets/beers/groups/reviewers'})
+        self.assertEquals(self.permission.get_user_principals('mat'),
+                          {'/buckets/beers/groups/reviewers'})
+
     def test_group_member_removal_updates_user_principals_with_patch(self):
         self.create_group('beers', 'moderators', ['natim', 'mat'])
         group_url = '/buckets/beers/groups/moderators'