{"action":"created","comment":{"url":"https://api.github.com/repos/fabric8-services/fabric8-auth/pulls/comments/180616102","pull_request_review_id":111066563,"id":180616102,"diff_hunk":"@@ -69,6 +82,62 @@ func (c *ResourceRolesController) ListAssignedByRoleName(ctx *app.ListAssignedBy\n \t})\n }\n \n+// AssignRole assigns a specific role for a resource, to one or more identities.\n+func (c *ResourceRolesController) AssignRole(ctx *app.AssignRoleResourceRolesContext) error {\n+\n+\tcurrentUser, err := login.ContextIdentity(ctx)\n+\tif err != nil {\n+\t\treturn jsonapi.JSONErrorResponse(ctx, errors.NewUnauthorizedError(err.Error()))\n+\t}\n+\tif currentUser == nil {\n+\t\treturn jsonapi.JSONErrorResponse(ctx, errors.NewUnauthorizedError(\"identity ID not found in token\"))\n+\t}\n+\n+\t// check if the current user token belongs to a user who has the necessary privileges\n+\t// for assigning roles to other users.\n+\thasScope, err := c.permissionService.HasScope(ctx, *currentUser, ctx.ResourceID, ROLE_ASSIGNMENT_SCOPE)\n+\tif err != nil {\n+\t\treturn jsonapi.JSONErrorResponse(ctx, err)\n+\t}\n+\tif !hasScope {\n+\t\treturn jsonapi.JSONErrorResponse(ctx, errors.NewForbiddenError(\"user is not authorized to assign roles\"))","path":"controller/resource_roles.go","position":66,"original_position":66,"commit_id":"38d7a6cb2b1684f7df309b6058a40024076cbcf5","original_commit_id":"38d7a6cb2b1684f7df309b6058a40024076cbcf5","user":{"login":"sbryzak","id":165507,"avatar_url":"https://avatars0.githubusercontent.com/u/165507?v=4","gravatar_id":"","url":"https://api.github.com/users/sbryzak","html_url":"https://github.com/sbryzak","followers_url":"https://api.github.com/users/sbryzak/followers","following_url":"https://api.github.com/users/sbryzak/following{/other_user}","gists_url":"https://api.github.com/users/sbryzak/gists{/gist_id}","starred_url":"https://api.github.com/users/sbryzak/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sbryzak/subscriptions","organizations_url":"https://api.github.com/users/sbryzak/orgs","repos_url":"https://api.github.com/users/sbryzak/repos","events_url":"https://api.github.com/users/sbryzak/events{/privacy}","received_events_url":"https://api.github.com/users/sbryzak/received_events","type":"User","site_admin":false},"body":"@alexeykazakov I did some quick refresher research on this, there is actually a problem with the 401 response in that the standard seems to incorrectly label is as 'Unauthorized' when in actual fact the error code is used to return an authentication error.  I.e. the user hasn't authenticated, or their authentication is incorrect somehow.  In this instead, I think @sbose78 's use of 403 is correct, as the user is definitely authenticated (otherwise they wouldn't have gotten this far) however they lack the scope necessary to perform the operation.  This is an easy mistake to make due to the confusion surrounding the http response codes, and I wouldn't be surprised if I've made it myself elsewhere in the code.","created_at":"2018-04-11T01:58:39Z","updated_at":"2018-04-11T01:58:39Z","html_url":"https://github.com/fabric8-services/fabric8-auth/pull/399#discussion_r180616102","pull_request_url":"https://api.github.com/repos/fabric8-services/fabric8-auth/pulls/399","author_association":"COLLABORATOR","_links":{"self":{"href":"https://api.github.com/repos/fabric8-services/fabric8-auth/pulls/comments/180616102"},"html":{"href":"https://github.com/fabric8-services/fabric8-auth/pull/399#discussion_r180616102"},"pull_request":{"href":"https://api.github.com/repos/fabric8-services/fabric8-auth/pulls/399"}},"in_reply_to_id":180603989},"pull_request":{"url":"https://api.github.com/repos/fabric8-services/fabric8-auth/pulls/399","id":176708100,"html_url":"https://github.com/fabric8-services/fabric8-auth/pull/399","diff_url":"https://github.com/fabric8-services/fabric8-auth/pull/399.diff","patch_url":"https://github.com/fabric8-services/fabric8-auth/pull/399.patch","issue_url":"https://api.github.com/repos/fabric8-services/fabric8-auth/issues/399","number":399,"state":"open","locked":false,"title":"Add API to assign a role","user":{"login":"sbose78","id":545280,"avatar_url":"https://avatars3.githubusercontent.com/u/545280?v=4","gravatar_id":"","url":"https://api.github.com/users/sbose78","html_url":"https://github.com/sbose78","followers_url":"https://api.github.com/users/sbose78/followers","following_url":"https://api.github.com/users/sbose78/following{/other_user}","gists_url":"https://api.github.com/users/sbose78/gists{/gist_id}","starred_url":"https://api.github.com/users/sbose78/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sbose78/subscriptions","organizations_url":"https://api.github.com/users/sbose78/orgs","repos_url":"https://api.github.com/users/sbose78/repos","events_url":"https://api.github.com/users/sbose78/events{/privacy}","received_events_url":"https://api.github.com/users/sbose78/received_events","type":"User","site_admin":false},"body":"fixes #398 \r\n\r\n```\r\nPATCH /api/resources/:resourceID/roles/:roleName\r\nAuthorization: Bearer <AccessToken>\r\n{\r\n  \"data\": [\r\n    { \"type\": \"identities\", \"id\": \"<identityID1>\" },\r\n    { \"type\": \"identities\", \"id\": \"<identityID2>\" },\r\n    ...\r\n  ]\r\n}\r\n```\r\n\r\n- [x] support for assigning multiple identityIDs\r\n- [x] determine if the user who is assigning the role has sufficient privileges to do so.\r\n- [x] controller\r\n- [x] controller tests\r\n- [x] service \r\n- [x] service tests\r\n- [x] model\r\n- [x] model tests\r\n\r\n","created_at":"2018-03-22T08:44:06Z","updated_at":"2018-04-11T01:58:39Z","closed_at":null,"merged_at":null,"merge_commit_sha":"8ac7f4b56eb102f3dbabe20f4913b50bb3b3d5d3","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[],"milestone":null,"commits_url":"https://api.github.com/repos/fabric8-services/fabric8-auth/pulls/399/commits","review_comments_url":"https://api.github.com/repos/fabric8-services/fabric8-auth/pulls/399/comments","review_comment_url":"https://api.github.com/repos/fabric8-services/fabric8-auth/pulls/comments{/number}","comments_url":"https://api.github.com/repos/fabric8-services/fabric8-auth/issues/399/comments","statuses_url":"https://api.github.com/repos/fabric8-services/fabric8-auth/statuses/38d7a6cb2b1684f7df309b6058a40024076cbcf5","head":{"label":"sbose78:assign-role","ref":"assign-role","sha":"38d7a6cb2b1684f7df309b6058a40024076cbcf5","user":{"login":"sbose78","id":545280,"avatar_url":"https://avatars3.githubusercontent.com/u/545280?v=4","gravatar_id":"","url":"https://api.github.com/users/sbose78","html_url":"https://github.com/sbose78","followers_url":"https://api.github.com/users/sbose78/followers","following_url":"https://api.github.com/users/sbose78/following{/other_user}","gists_url":"https://api.github.com/users/sbose78/gists{/gist_id}","starred_url":"https://api.github.com/users/sbose78/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sbose78/subscriptions","organizations_url":"https://api.github.com/users/sbose78/orgs","repos_url":"https://api.github.com/users/sbose78/repos","events_url":"https://api.github.com/users/sbose78/events{/privacy}","received_events_url":"https://api.github.com/users/sbose78/received_events","type":"User","site_admin":false},"repo":{"id":122318411,"name":"fabric8-auth","full_name":"sbose78/fabric8-auth","owner":{"login":"sbose78","id":545280,"avatar_url":"https://avatars3.githubusercontent.com/u/545280?v=4","gravatar_id":"","url":"https://api.github.com/users/sbose78","html_url":"https://github.com/sbose78","followers_url":"https://api.github.com/users/sbose78/followers","following_url":"https://api.github.com/users/sbose78/following{/other_user}","gists_url":"https://api.github.com/users/sbose78/gists{/gist_id}","starred_url":"https://api.github.com/users/sbose78/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sbose78/subscriptions","organizations_url":"https://api.github.com/users/sbose78/orgs","repos_url":"https://api.github.com/users/sbose78/repos","events_url":"https://api.github.com/users/sbose78/events{/privacy}","received_events_url":"https://api.github.com/users/sbose78/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/sbose78/fabric8-auth","description":"Identity and Access Management for fabric8 services","fork":true,"url":"https://api.github.com/repos/sbose78/fabric8-auth","forks_url":"https://api.github.com/repos/sbose78/fabric8-auth/forks","keys_url":"https://api.github.com/repos/sbose78/fabric8-auth/keys{/key_id}","collaborators_url":"https://api.github.com/repos/sbose78/fabric8-auth/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/sbose78/fabric8-auth/teams","hooks_url":"https://api.github.com/repos/sbose78/fabric8-auth/hooks","issue_events_url":"https://api.github.com/repos/sbose78/fabric8-auth/issues/events{/number}","events_url":"https://api.github.com/repos/sbose78/fabric8-auth/events","assignees_url":"https://api.github.com/repos/sbose78/fabric8-auth/assignees{/user}","branches_url":"https://api.github.com/repos/sbose78/fabric8-auth/branches{/branch}","tags_url":"https://api.github.com/repos/sbose78/fabric8-auth/tags","blobs_url":"https://api.github.com/repos/sbose78/fabric8-auth/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/sbose78/fabric8-auth/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/sbose78/fabric8-auth/git/refs{/sha}","trees_url":"https://api.github.com/repos/sbose78/fabric8-auth/git/trees{/sha}","statuses_url":"https://api.github.com/repos/sbose78/fabric8-auth/statuses/{sha}","languages_url":"https://api.github.com/repos/sbose78/fabric8-auth/languages","stargazers_url":"https://api.github.com/repos/sbose78/fabric8-auth/stargazers","contributors_url":"https://api.github.com/repos/sbose78/fabric8-auth/contributors","subscribers_url":"https://api.github.com/repos/sbose78/fabric8-auth/subscribers","subscription_url":"https://api.github.com/repos/sbose78/fabric8-auth/subscription","commits_url":"https://api.github.com/repos/sbose78/fabric8-auth/commits{/sha}","git_commits_url":"https://api.github.com/repos/sbose78/fabric8-auth/git/commits{/sha}","comments_url":"https://api.github.com/repos/sbose78/fabric8-auth/comments{/number}","issue_comment_url":"https://api.github.com/repos/sbose78/fabric8-auth/issues/comments{/number}","contents_url":"https://api.github.com/repos/sbose78/fabric8-auth/contents/{+path}","compare_url":"https://api.github.com/repos/sbose78/fabric8-auth/compare/{base}...{head}","merges_url":"https://api.github.com/repos/sbose78/fabric8-auth/merges","archive_url":"https://api.github.com/repos/sbose78/fabric8-auth/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/sbose78/fabric8-auth/downloads","issues_url":"https://api.github.com/repos/sbose78/fabric8-auth/issues{/number}","pulls_url":"https://api.github.com/repos/sbose78/fabric8-auth/pulls{/number}","milestones_url":"https://api.github.com/repos/sbose78/fabric8-auth/milestones{/number}","notifications_url":"https://api.github.com/repos/sbose78/fabric8-auth/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/sbose78/fabric8-auth/labels{/name}","releases_url":"https://api.github.com/repos/sbose78/fabric8-auth/releases{/id}","deployments_url":"https://api.github.com/repos/sbose78/fabric8-auth/deployments","created_at":"2018-02-21T09:51:46Z","updated_at":"2018-02-21T09:51:48Z","pushed_at":"2018-04-10T16:07:08Z","git_url":"git://github.com/sbose78/fabric8-auth.git","ssh_url":"git@github.com:sbose78/fabric8-auth.git","clone_url":"https://github.com/sbose78/fabric8-auth.git","svn_url":"https://github.com/sbose78/fabric8-auth","homepage":"","size":5618,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0"},"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"fabric8-services:master","ref":"master","sha":"9aca2da0c51a690bb7bd6611e2ed2c8356beaecd","user":{"login":"fabric8-services","id":29751612,"avatar_url":"https://avatars1.githubusercontent.com/u/29751612?v=4","gravatar_id":"","url":"https://api.github.com/users/fabric8-services","html_url":"https://github.com/fabric8-services","followers_url":"https://api.github.com/users/fabric8-services/followers","following_url":"https://api.github.com/users/fabric8-services/following{/other_user}","gists_url":"https://api.github.com/users/fabric8-services/gists{/gist_id}","starred_url":"https://api.github.com/users/fabric8-services/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fabric8-services/subscriptions","organizations_url":"https://api.github.com/users/fabric8-services/orgs","repos_url":"https://api.github.com/users/fabric8-services/repos","events_url":"https://api.github.com/users/fabric8-services/events{/privacy}","received_events_url":"https://api.github.com/users/fabric8-services/received_events","type":"Organization","site_admin":false},"repo":{"id":96831576,"name":"fabric8-auth","full_name":"fabric8-services/fabric8-auth","owner":{"login":"fabric8-services","id":29751612,"avatar_url":"https://avatars1.githubusercontent.com/u/29751612?v=4","gravatar_id":"","url":"https://api.github.com/users/fabric8-services","html_url":"https://github.com/fabric8-services","followers_url":"https://api.github.com/users/fabric8-services/followers","following_url":"https://api.github.com/users/fabric8-services/following{/other_user}","gists_url":"https://api.github.com/users/fabric8-services/gists{/gist_id}","starred_url":"https://api.github.com/users/fabric8-services/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fabric8-services/subscriptions","organizations_url":"https://api.github.com/users/fabric8-services/orgs","repos_url":"https://api.github.com/users/fabric8-services/repos","events_url":"https://api.github.com/users/fabric8-services/events{/privacy}","received_events_url":"https://api.github.com/users/fabric8-services/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/fabric8-services/fabric8-auth","description":"Identity and Access Management for fabric8 services","fork":false,"url":"https://api.github.com/repos/fabric8-services/fabric8-auth","forks_url":"https://api.github.com/repos/fabric8-services/fabric8-auth/forks","keys_url":"https://api.github.com/repos/fabric8-services/fabric8-auth/keys{/key_id}","collaborators_url":"https://api.github.com/repos/fabric8-services/fabric8-auth/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/fabric8-services/fabric8-auth/teams","hooks_url":"https://api.github.com/repos/fabric8-services/fabric8-auth/hooks","issue_events_url":"https://api.github.com/repos/fabric8-services/fabric8-auth/issues/events{/number}","events_url":"https://api.github.com/repos/fabric8-services/fabric8-auth/events","assignees_url":"https://api.github.com/repos/fabric8-services/fabric8-auth/assignees{/user}","branches_url":"https://api.github.com/repos/fabric8-services/fabric8-auth/branches{/branch}","tags_url":"https://api.github.com/repos/fabric8-services/fabric8-auth/tags","blobs_url":"https://api.github.com/repos/fabric8-services/fabric8-auth/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/fabric8-services/fabric8-auth/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/fabric8-services/fabric8-auth/git/refs{/sha}","trees_url":"https://api.github.com/repos/fabric8-services/fabric8-auth/git/trees{/sha}","statuses_url":"https://api.github.com/repos/fabric8-services/fabric8-auth/statuses/{sha}","languages_url":"https://api.github.com/repos/fabric8-services/fabric8-auth/languages","stargazers_url":"https://api.github.com/repos/fabric8-services/fabric8-auth/stargazers","contributors_url":"https://api.github.com/repos/fabric8-services/fabric8-auth/contributors","subscribers_url":"https://api.github.com/repos/fabric8-services/fabric8-auth/subscribers","subscription_url":"https://api.github.com/repos/fabric8-services/fabric8-auth/subscription","commits_url":"https://api.github.com/repos/fabric8-services/fabric8-auth/commits{/sha}","git_commits_url":"https://api.github.com/repos/fabric8-services/fabric8-auth/git/commits{/sha}","comments_url":"https://api.github.com/repos/fabric8-services/fabric8-auth/comments{/number}","issue_comment_url":"https://api.github.com/repos/fabric8-services/fabric8-auth/issues/comments{/number}","contents_url":"https://api.github.com/repos/fabric8-services/fabric8-auth/contents/{+path}","compare_url":"https://api.github.com/repos/fabric8-services/fabric8-auth/compare/{base}...{head}","merges_url":"https://api.github.com/repos/fabric8-services/fabric8-auth/merges","archive_url":"https://api.github.com/repos/fabric8-services/fabric8-auth/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/fabric8-services/fabric8-auth/downloads","issues_url":"https://api.github.com/repos/fabric8-services/fabric8-auth/issues{/number}","pulls_url":"https://api.github.com/repos/fabric8-services/fabric8-auth/pulls{/number}","milestones_url":"https://api.github.com/repos/fabric8-services/fabric8-auth/milestones{/number}","notifications_url":"https://api.github.com/repos/fabric8-services/fabric8-auth/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/fabric8-services/fabric8-auth/labels{/name}","releases_url":"https://api.github.com/repos/fabric8-services/fabric8-auth/releases{/id}","deployments_url":"https://api.github.com/repos/fabric8-services/fabric8-auth/deployments","created_at":"2017-07-10T23:57:55Z","updated_at":"2018-04-10T14:52:02Z","pushed_at":"2018-04-10T16:07:10Z","git_url":"git://github.com/fabric8-services/fabric8-auth.git","ssh_url":"git@github.com:fabric8-services/fabric8-auth.git","clone_url":"https://github.com/fabric8-services/fabric8-auth.git","svn_url":"https://github.com/fabric8-services/fabric8-auth","homepage":"https://auth.openshift.io/api/status","size":5522,"stargazers_count":6,"watchers_count":6,"language":"Go","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":20,"mirror_url":null,"archived":false,"open_issues_count":64,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0"},"forks":20,"open_issues":64,"watchers":6,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/fabric8-services/fabric8-auth/pulls/399"},"html":{"href":"https://github.com/fabric8-services/fabric8-auth/pull/399"},"issue":{"href":"https://api.github.com/repos/fabric8-services/fabric8-auth/issues/399"},"comments":{"href":"https://api.github.com/repos/fabric8-services/fabric8-auth/issues/399/comments"},"review_comments":{"href":"https://api.github.com/repos/fabric8-services/fabric8-auth/pulls/399/comments"},"review_comment":{"href":"https://api.github.com/repos/fabric8-services/fabric8-auth/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/fabric8-services/fabric8-auth/pulls/399/commits"},"statuses":{"href":"https://api.github.com/repos/fabric8-services/fabric8-auth/statuses/38d7a6cb2b1684f7df309b6058a40024076cbcf5"}},"author_association":"MEMBER"}}
{"actor":{"display_login":"sbryzak"}}