Foo Developer created FINERACT-2866:
---------------------------------------
Summary: A renamed report, or one whose permission was granted to
a role, cannot be deleted
Key: FINERACT-2866
URL: https://issues.apache.org/jira/browse/FINERACT-2866
Project: Apache Fineract
Issue Type: Bug
Components: Reports
Reporter: Foo Developer
Assignee: Foo Developer
h3. Summary
Creating a report ({{POST /reports}}) also creates its {{READ_<reportName>}}
permission, and deleting it ({{DELETE /reports/{id}}}) looks that permission up
by the report's _current_ name and deletes it. Two defects in
{{ReportWritePlatformServiceImpl}} make a user-created report impossible to
delete:
# *Renaming a report does not rename its permission.* {{updateReport}} changes
{{reportName}} but never touches the companion {{m_permission}} row, so the
permission keeps the old {{READ_<oldName>}} code. Users/roles then see and
grant a permission named after a report that no longer exists, and
{{deleteReport}} later fails with {{PermissionNotFoundException: Permission
with Code READ_<newName> does not exist}} — the report can never be deleted.
# *Deleting a report whose READ permission was granted to a role fails.*
{{deleteReport}} calls {{permissionRepository.delete(permission)}} directly.
{{m_role_permission}} is maintained only from the owning {{Role}} side of the
{{@ManyToMany}}, so the join rows are not removed and the delete violates the
{{m_role_permission}} → {{m_permission}} foreign key.
h3. Steps to reproduce
Rename case:
# {{POST /fineract-provider/api/v1/reports}}
{code:json} {"reportName": "Rename test", "reportType": "Table",
"reportCategory": "Client", "reportSql": "select 1", "useReport": true}
{code}
# {{PUT /fineract-provider/api/v1/reports/{id}}} with {{{"reportName": "Rename
test 2"}}} → 200.
# {{GET /fineract-provider/api/v1/permissions}} still lists {{READ_Rename
test}}, and no {{READ_Rename test 2}}.
# {{DELETE /fineract-provider/api/v1/reports/{id}}} → *404*
{{error.msg.resource.not.found}} / {{error.msg.permission.code.invalid}}:
"Permission with Code READ\_Rename test 2 does not exist". The report stays and
can never be deleted through the API.
Role grant case:
# Create a report as above (name {{Grant test}}).
# {{PUT /fineract-provider/api/v1/roles/{roleId}/permissions}} with
{{{"permissions": {"READ_Grant test": true}}}}.
# {{DELETE /fineract-provider/api/v1/reports/{id}}} → *403*
{{error.msg.data.integrity.issue}}: {{update or delete on table "m_permission"
violates foreign key constraint "fk8dedb048103b544b" on table
"m_role_permission"}}. The transaction rolls back and the report stays.
h3. Expected
Renaming a report renames its {{READ_}} permission; deleting a report removes
the report and its permission, including any role grants of it.
h3. Actual
Reproduced on current {{develop}}: 404 in the rename case, 403 (data integrity)
in the role-grant case; the report cannot be deleted in either case.
h3. Proposed fix
* {{Permission.updateEntityName(String)}} recomputes {{entityName}} and
{{code}}; {{updateReport}} looks up {{READ_<previousName>}} when {{reportName}}
changes and renames it.
* {{deleteReport}} tolerates a missing permission (logs a warning and deletes
the report), so reports already renamed before the fix can still be deleted.
* {{RoleRepository.findByPermissionId(Long)}}; {{deleteReport}} removes the
permission from every role holding it before deleting the permission.
A unit test ({{ReportWritePlatformServiceImplPermissionTest}}) covers rename,
update without rename, delete with no permission, and delete with a role grant.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
