Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

馃悰 Bug Report: with Users limited to 1, creating team membership in console gives restricted error #5516

Closed
2 tasks done
jhooper04 opened this issue May 8, 2023 · 18 comments 路 Fixed by #8122
Closed
2 tasks done
Assignees
Labels
bug Something isn't working community PR or issues handled by the community members who may need guidance from core good first issue Good for newcomers product / auth Fixes and upgrades for the Appwrite Auth / Users / Teams services.

Comments

@jhooper04
Copy link

jhooper04 commented May 8, 2023

馃憻 Reproduction steps

  1. Auth -> Security, set Users limit to 1.
  2. Auth -> Teams, Create a new team
  3. Select the new team and select Members tab
  4. Press the create membership button
  5. Add a new unregistered user email address with any roles/name

馃憤 Expected behavior

It should create the new user for that email address if it doesn't exist (ideally with a confirmation?) even though the user limit is exceeded since it is being created through the console or via an API key.

馃憥 Actual Behavior

It returns an error message "Project registration is restricted. Contact your administrator for more information."
It works as expected if the user/email already exists.

馃幉 Appwrite version

Version 1.3.x

馃捇 Operating system

Linux

馃П Your Environment

I am using 1.3.4 through the console on a self hosted localhost linux development environment with _APP_ENV=development

馃憖 Have you spent some time to check if this issue has been raised before?

  • I checked and didn't find similar issue

馃彚 Have you read the Code of Conduct?

@jhooper04 jhooper04 added the bug Something isn't working label May 8, 2023
@stnguyen90 stnguyen90 added the product / auth Fixes and upgrades for the Appwrite Auth / Users / Teams services. label May 8, 2023
@stnguyen90 stnguyen90 self-assigned this May 8, 2023
@stnguyen90
Copy link
Contributor

@jhooper04 thanks for creating this issue! 馃檹馃徏 Let me double check with the team we want this type of behavior.

@stnguyen90
Copy link
Contributor

I checked with the team and we agreed this is something we should have.

@stnguyen90 stnguyen90 added the good first issue Good for newcomers label May 10, 2023
@stnguyen90 stnguyen90 removed their assignment May 10, 2023
@lucifer-Hell
Copy link

hi @stnguyen90 I would be really happy to fix this issue . If possible can you please assign this to me ?

@stnguyen90
Copy link
Contributor

@lucifer-Hell assigned! Thanks for your interest! 馃檹

@stnguyen90 stnguyen90 added this to the 1.4.0 milestone May 14, 2023
@lucifer-Hell
Copy link

Hi team just a quick update . It seems that whenever the create event is called for a member to be created the project id which is passed to the register function is not console. Hence it throws the error. Below is the line code which checks the project id : -
if ($limit !== 0 && $project->getId() !== 'console') { // check users limit, console invites are always allowed.
I am trying to find out what would be the possible reason for the same.

@stnguyen90
Copy link
Contributor

@lucifer-Hell, yes, that is correct. The project ID would be the project ID in which the team membership is being created in.

FYI, you can add a permalink on GitHub and it will render the code. For example:

if ($limit !== 0 && $project->getId() !== 'console') { // check users limit, console invites are allways allowed.

@lucifer-Hell
Copy link

Hi @stnguyen90 , i have proposal to fix this bug . Rather then relying onproject->getId() we can you use the header x-sdk-platform which comes along the request to check whether the incoming request is from console or not. Following is the change that i am thinking of . Please let me know if this seems okay

$platformType= $request->header('x-sdk-platform', 'default'); if ($limit !== 0 && $platformType !== 'console') { // check users limit, console invites are allways allowed. $total = $dbForProject->count('users', [], APP_LIMIT_USERS);

Also thanks! for the permalink suggestion I will use the same in my prs from know onwards .

@stnguyen90
Copy link
Contributor

we can you use the header x-sdk-platform which comes along the request

@lucifer-Hell, it's typically not a good idea to rely on client-supplied data like that since the client can send any value it wants.

@safwanyp
Copy link
Contributor

This is the current code

if (empty($invitee)) { // Create new user if no user with same email found
$limit = $project->getAttribute('auths', [])['limit'] ?? 0;
if ($limit !== 0 && $project->getId() !== 'console') { // check users limit, console invites are allways allowed.
$total = $dbForProject->count('users', [], APP_LIMIT_USERS);
if ($total >= $limit) {
throw new Exception(Exception::USER_COUNT_EXCEEDED, 'Project registration is restricted. Contact your administrator for more information.');
}
}
try {
$userId = ID::unique();
$invitee = Authorization::skip(fn() => $dbForProject->createDocument('users', new Document([
'$id' => $userId,

Can't we simply do something like this?

if (empty($invitee)) { // Create new user if no user with same email found
  $limit = $project->getAttribute('auths', [])['limit'] ?? 0;

  $isPrivilegedUser ? $limit = 0 : null; // <----- I added this line

  if ($limit !== 0 && $project->getId() !== 'console') { // check users limit, console invites are allways allowed.
      $total = $dbForProject->count('users', [], APP_LIMIT_USERS);
      // rest of the code

@stnguyen90
Copy link
Contributor

@safwanyp, I'd probably leave the limit number rather than modifying it based on $isPrivilegedUser for clarity.

@safwanyp
Copy link
Contributor

@stnguyen90 Noted, and I did this instead:

if (empty($invitee)) { // Create new user if no user with same email found
  $limit = $project->getAttribute('auths', [])['limit'] ?? 0;

  $shouldCheckLimit = !$isPrivilegedUser && $limit !== 0 && $project->getId() !== 'console';

  if ($shouldCheckLimit) { // check users limit, console invites are allways allowed.
      $total = $dbForProject->count('users', [], APP_LIMIT_USERS);

      if ($total >= $limit) {
          throw new Exception(Exception::USER_COUNT_EXCEEDED, 'Project registration is restricted. Contact your administrator for more information.');
      }
  }
  // rest of the code

Instead of modifying $limit directly, I created $shouldCheckLimit that checks whether the limit should be taken into account or not.

@stnguyen90 stnguyen90 removed this from the 1.4.0 milestone Sep 22, 2023
@stnguyen90
Copy link
Contributor

@lucifer-Hell, how's your progress on this?

@ketanbaitule
Copy link
Contributor

As the previous assignee is not working on it, can you assign it to me

@ketanbaitule
Copy link
Contributor

ketanbaitule commented Nov 13, 2023

Just realised @safwanyp had already got the solution

@nick2432
Copy link

can i work on this?

@stnguyen90
Copy link
Contributor

Unassigning due to inactivity.

@ketanbaitule, @nick2432, are y'all still interested in working on this?

@ketanbaitule
Copy link
Contributor

Hi @stnguyen90, I am interested to work on this issue.

Unassigning due to inactivity.

@ketanbaitule, @nick2432, are y'all still interested in working on this?

@stnguyen90
Copy link
Contributor

@ketanbaitule, assigned! Thanks for your interest! 馃檹

@stnguyen90 stnguyen90 added the community PR or issues handled by the community members who may need guidance from core label May 6, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working community PR or issues handled by the community members who may need guidance from core good first issue Good for newcomers product / auth Fixes and upgrades for the Appwrite Auth / Users / Teams services.
Projects
Status: Done
Development

Successfully merging a pull request may close this issue.

6 participants