signalapp/storage-service
signalapp/storage-service
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

remove edit-attributes permission check for group member labels
Some checks failed
Build and test / build (push) Has been cancelled
Details

Browse Source
This commit is contained in:
Jonathan Klabunde Tomer 2026-02-26 15:01:19 -08:00 committed by GitHub
parent cb145839d1
commit 73e4f8ad52
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 0 additions and 63 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/main/java/org/signal/storageservice/groups/GroupChangeApplicator.java
View File

@ -187,11 +187,6 @@ public class GroupChangeApplicator {
.orElseThrow(() -> new ForbiddenException())
.getRole() == Member.Role.ADMINISTRATOR;
// changing labels requires modify-attributes permission
if (!GroupAuth.isModifyAttributesAllowed(user, group)) {
throw new ForbiddenException("modifying label requires modify-group-attributes permission");
}
final Map<ByteString, Member.Builder> memberBuilders = modifiedGroupBuilder.getMembersBuilderList().stream()
.collect(Collectors.toMap(Member.Builder::getUserId, Function.identity()));

58
src/test/java/org/signal/storageservice/controllers/GroupsControllerTest.java
View File

@ -3864,64 +3864,6 @@ class GroupsControllerTest extends BaseGroupsControllerTest {
new NotarySignature(signedChange.getServerSignature().toByteArray()));
}
@Test
void testModifyMemberLabelMemberWithoutAttributePermission() {
GroupSecretParams groupSecretParams = GroupSecretParams.generate();
GroupPublicParams groupPublicParams = groupSecretParams.getPublicParams();
ProfileKeyCredentialPresentation validUserPresentation =
new ClientZkProfileOperations(AuthHelper.GROUPS_SERVER_KEY.getPublicParams())
.createProfileKeyCredentialPresentation(
groupSecretParams, AuthHelper.VALID_USER_PROFILE_CREDENTIAL);
ProfileKeyCredentialPresentation validUserTwoPresentation =
new ClientZkProfileOperations(AuthHelper.GROUPS_SERVER_KEY.getPublicParams())
.createProfileKeyCredentialPresentation(groupSecretParams, AuthHelper.VALID_USER_TWO_PROFILE_CREDENTIAL);
Group group = Group.newBuilder()
.setPublicKey(ByteString.copyFrom(groupPublicParams.serialize()))
.setAccessControl(AccessControl.newBuilder()
.setMembers(AccessControl.AccessRequired.MEMBER)
.setAttributes(AccessControl.AccessRequired.ADMINISTRATOR))
.setTitle(ByteString.copyFromUtf8("Some title"))
.setAvatarUrl(avatarFor(groupPublicParams.getGroupIdentifier().serialize()))
.setVersion(0)
.addMembers(Member.newBuilder()
.setUserId(ByteString.copyFrom(validUserPresentation.getUuidCiphertext().serialize()))
.setProfileKey(ByteString.copyFrom(validUserTwoPresentation.getProfileKeyCiphertext().serialize()))
.setRole(Member.Role.ADMINISTRATOR)
.build())
.addMembers(Member.newBuilder()
.setUserId(ByteString.copyFrom(validUserTwoPresentation.getUuidCiphertext().serialize()))
.setProfileKey(ByteString.copyFrom(validUserTwoPresentation.getProfileKeyCiphertext().serialize()))
.setRole(Member.Role.DEFAULT)
.build())
.build();
when(groupsManager.getGroup(eq(ByteString.copyFrom(groupPublicParams.getGroupIdentifier().serialize()))))
.thenReturn(CompletableFuture.completedFuture(Optional.of(group)));
GroupChange.Actions groupChange = GroupChange.Actions.newBuilder()
.setVersion(1)
.addModifyMemberLabel(
Actions.ModifyMemberLabelAction.newBuilder()
.setUserId(ByteString.copyFrom(validUserTwoPresentation.getUuidCiphertext().serialize()))
.setLabelEmoji(ByteString.copyFromUtf8("emoji ciphertext"))
.setLabelString(ByteString.copyFromUtf8("label ciphertext")))
.build();
Response response = resources.getJerseyTest()
.target("/v2/groups/")
.request(ProtocolBufferMediaType.APPLICATION_PROTOBUF)
.header("Authorization", AuthHelper.getAuthHeader(groupSecretParams, AuthHelper.VALID_USER_TWO_AUTH_CREDENTIAL))
.method("PATCH", Entity.entity(groupChange.toByteArray(), ProtocolBufferMediaType.APPLICATION_PROTOBUF));
assertThat(response.getStatus()).isEqualTo(403);
verify(groupsManager).getGroup(eq(ByteString.copyFrom(groupPublicParams.getGroupIdentifier().serialize())));
verifyNoMoreInteractions(groupsManager);
}
@Test
void testModifyMemberLabelOtherMember() {
GroupSecretParams groupSecretParams = GroupSecretParams.generate();