Don't treat permission name as a machine readable field, use slug instead #115

Merged
Oleg-Komarov merged 2 commits from permissions-use-slug into main 2024-05-06 17:40:07 +02:00
Owner

Fixes #109,

We noticed a discrepancy in behavior between sqlite (case-insensitive like) and postgresql (case-sensitive like) because a lookup was happening against a name column, which is titlecased, but the permission ids (slugs) in manifest are lowercase.
The fix is to use the slug field, and to perform an exact match, not a LIKE.

This PR also make sure that slug fields in VersionPermission and License models are unique (doesn't do it for Tag, but we should fix that as well), and cleans up some unused code in the affected models.

Fixes #109, We noticed a discrepancy in behavior between sqlite (case-insensitive like) and postgresql (case-sensitive like) because a lookup was happening against a `name` column, which is titlecased, but the permission ids (slugs) in manifest are lowercase. The fix is to use the `slug` field, and to perform an exact match, not a LIKE. This PR also make sure that slug fields in VersionPermission and License models are unique (doesn't do it for Tag, but we should fix that as well), and cleans up some unused code in the affected models.
Oleg-Komarov added 1 commit 2024-05-06 15:12:53 +02:00
This also fixes a discrepancy in behavior between sqlite (case-insensitive
like) and postgresql (case-sensitive like), since we expect slugs to always be
lowercase.
Oleg-Komarov reviewed 2024-05-06 15:43:00 +02:00
@ -407,4 +385,2 @@
@classmethod
def get_by_slug(cls, slug: str):
return cls.objects.filter(slug__startswith=slug).first()
Author
Owner

I'm replacing this with an exact match. Was there any usecase to do a prefix match?

I'm replacing this with an exact match. Was there any usecase to do a prefix match?

I don't recall, if it wasn't explained on the corresponding commit than just assume an exact match should be fine. I think I copied this over from the license and other code snippets

I don't recall, if it wasn't explained on the corresponding commit than just assume an exact match should be fine. I think I copied this over from the license and other code snippets
Oleg-Komarov marked this conversation as resolved
Oleg-Komarov reviewed 2024-05-06 16:21:39 +02:00
@ -541,3 +517,4 @@
permission = VersionPermission.get_by_slug(permission_name)
# Just ignore versions that are incompatible.
if not permission:
Author
Owner

@dfelinto here we explicitly allow to submit a manifest with incorrect permissions names. is it intentional? shouldn't we return a validation error instead if somebody mistypes a permission slug?

@dfelinto here we explicitly allow to submit a manifest with incorrect permissions names. is it intentional? shouldn't we return a validation error instead if somebody mistypes a permission slug?

Right, it should be an error indeed. Maybe already is (caught early on by the validator)?

Right, it should be an error indeed. Maybe already is (caught early on by the validator)?
Oleg-Komarov marked this conversation as resolved
Oleg-Komarov added 1 commit 2024-05-06 17:35:37 +02:00
Anna Sirota approved these changes 2024-05-06 17:39:05 +02:00
Oleg-Komarov merged commit 6167f991f5 into main 2024-05-06 17:40:07 +02:00
Oleg-Komarov deleted branch permissions-use-slug 2024-05-06 17:40:08 +02:00
Sign in to join this conversation.
No reviewers
No Milestone
No project
No Assignees
3 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: infrastructure/extensions-website#115
No description provided.