DependencyTrack / DependencyTrack/dependency-track
Permissions not set in Team creation
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
Hello,
I was trying to create a team using dependecytrack APIs but I noticed that even if permissions were specified, none were setted after team creation
Example:
Request payload:
{'name': team , 'permissions': [{'name': "PORTFOLIO_MANAGEMENT"}] }
API Log:
DEBUG:urllib3.connectionpool:https://deptrack.url:443 "PUT /api/v1/team HTTP/1.1" 201 189
DEBUG:root:{'uuid': 'd05b7d64-6939-49e0-9442-147cf130d8c1', 'name': 'team-name', 'apiKeys': [], 'ldapUsers': [], 'managedUsers': [], 'oidcUsers': [], 'mappedLdapGroups': [], 'mappedOidcGroups': [], 'permissions': []}
Also POST method did not work. Looking at the deptrack code I saw a TODO on v1/team POST endpoint
Using UI I found that permissions were set using another endpoint : '/api/v1/permission/'+permission+'/team/'+teamUuid
### Steps to Reproduce
curl -X POST "https://deptrack-url.com/api/v1/team" \
-H "Content-Type: application/json" \
-H "X-Api-Key: TOKEN" \
-d '{
"name": "Superteam",
"permissions": [
{ "name": "PORTFOLIO_MANAGEMENT" },
{ "name": "VIEW_BADGES" },
{ "name": "VIEW_POLICY_VIOLATION" },
{ "name": "VIEW_PORTFOLIO" },
{ "name": "VIEW_VULNERABILITY" },
{ "name": "VULNERABILITY_ANALYSIS" },
{ "name": "VULNERABILITY_MANAGEMENT" }
]
}'
### Expected Behavior
Once team is created permissions are set
### Dependency-Track Version
4.12.7
### Dependency-Track Distribution
Container Image
### Database Server
PostgreSQL
### Database Server Version
_No response_
### Browser
N/A
### Checklist
- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported
Contributor guide
Assessment
This issue has not been assessed yet.