Forbid deletion of special groups (users, clients, admins, billing-admins)
Nobody has claimed this yet.
- Dominant language
- Erlang
- Stars
- 303
- Forks
- 211
- Avg merge
- 1d 8h
- Merged PRs (30d)
- 5
Description
We currently allow users to delete 'special' groups.
A common example is someone deleting the users group. This horribly breaks user association, and because of the way ACLs are implemented is difficult to recover from since every single object will a require ACL fix to add users back.
We should forbid deletion of those groups. Probably the most straightforward way is to add a whitelist of groups that must not be deleted and check them in oc_chef_wm_named_group:delete_resource function.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in oc_chef_wm_named_group:delete_resource, which the issue identifies as the deletion entry point. Trace how named groups are checked before deletion and define the protected set for users, clients, admins, and billing-admins. Done means attempts to delete those groups are rejected while ordinary group deletion remains available.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- erlang
- Domain
- authorization, backend
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 42/100