key/fqfield error when requesting restricted field

[bastianjoel]

When requesting the following payload without an authentication token set an error is sent which does not seem right.

Request:

[
  {
    "collection": "user",
    "ids": [
      1
    ],
    "fields": {
      "default_password": null,
      "can_change_own_password": null,
      "title": null,
      "first_name": null,
      "last_name": null,
      "pronoun": null,
      "username": null,
      "gender": null,
      "default_number": null,
      "default_structure_level": null,
      "default_vote_weight": null,
      "is_physical_person": null,
      "is_active": null,
      "meeting_ids": null,
      "saml_id": null,
      "email": null,
      "last_email_sent": null,
      "last_login": null,
      "organization_management_level": null,
      "committee_ids": null,
      "committee_management_ids": null,
      "meeting_user_ids": {
        "type": "relation-list",
        "collection": "meeting_user",
        "fields": {
          "about_me": null,
          "user_id": null,
          "meeting_id": null,
          "group_ids": null,
          "vote_delegated_to_id": null,
          "vote_delegations_from_ids": {
            "type": "relation-list",
            "collection": "meeting_user",
            "fields": {
              "meeting_id": null,
              "group_ids": null,
              "id": null,
              "user_id": {
                "type": "relation",
                "collection": "user",
                "fields": {
                  "title": null,
                  "first_name": null,
                  "last_name": null,
                  "pronoun": null,
                  "username": null,
                  "gender": null,
                  "default_number": null,
                  "default_structure_level": null,
                  "default_vote_weight": null,
                  "meeting_user_ids": null,
                  "id": null
                }
              }
            }
          },
          "vote_weight": null,
          "comment": null,
          "structure_level": null,
          "number": null,
          "id": null
        }
      },
      "is_present_in_meeting_ids": null,
      "id": null
    }
  }
]

Error:

{
  "error": {
    "type": "invalid",
    "msg": "the key/fqfield is invalid: user/0/organization_management_level"
  }
}

Besides from that the error message is sent with a status code 200. It would be better to receive an authentication error or at least a non ok status code in that case.

[bastianjoel]

Sending the correct status is quite important here as the client uses that information to control certain recovery logic.

When resolving a long polling connection with a status code 200 the client currently assumes that the connection could be reopened immediately after a health check (for example after a reboot of the service).

[ostcar]

I can not reproduce the error.

I saved your request in a file called request. Afterwards, I called:

curl -k https://localhost:8000/system/autoupdate?single=true -d @request

When anonymous is disabled, I get an empty response:

{}

This is correct, since the anonymous can not see the user.

When I activate anonymous user for meeting 1, I get the following response:

{"meeting_user/1/group_ids":[2],"meeting_user/1/id":1,"meeting_user/1/meeting_id":1,"meeting_user/1/user_id":1,"user/1/default_vote_weight":"1.000000","user/1/id":1,"user/1/is_physical_person":true,"user/1/last_login":1697639243,"user/1/last_name":"Administrator","user/1/meeting_user_ids":[1],"user/1/username":"superadmin"}

To enable the anonymous user, I called:

./openslides-performance backend-action meeting.update '{"id":1,"enable_anonymous":true}'

[bastianjoel]

I cannot reproduce this anymore.

[bastianjoel]

I ran into this issue again today with current main.

[ostcar]

I ran into this issue again today with current main.

Can you tell me as detailed as possible, how I can reproduce it?

[bastianjoel]

I am using the dev setup with its unchanged example data (make run-dev).

When I do the first step as you described it:

curl -k https://localhost:8000/system/autoupdate?single=true -d @request

I get

{"error": {"type": "invalid", "msg": "the key/fqfield is invalid: user/0/organization_management_level"}}

[jsangmeister]

I can reproduce this.

[ostcar]

I had another look and was able to reproduce it. The problem was the field user/default_password. So it was also possible to cause the error with this call: curl -k 'https://localhost:8000/system/autoupdate?k=user/1/default_password'.

The reason for that error was, that I checked the DB-Field user/organization_management_level with the request user in the restricter for user/modeH. So in this case user/0/organization_management_level.

I checked all other places, where I do a DB request for the request user and found another case for the personal_note. I am confident, that I found all places and that the error should not happen again (future changes not included).