[AIRAVATA-2195] Shared user will end up with an experiment which he has no permission to view

• Type: Bug
• Status: Reopened
• Priority: Major
• Resolution: Unresolved
• Fix Version/s: 0.19
• Component/s: PGA PHP Web Gateway
• Environment: https://dev.seagrid.org
• Assignee: Marcus Christie
• Reporter: Eroma
• Created: 25/Oct/16 19:08
• Updated: 03/May/19 18:02

Description

Steps;
1. User A creates a a project and shares it with user B and user C
2. user A creates an experiment which is shared with both users B and C
3. User C clones and creates a new experiment and removes User A from the experiment. Only the experiment is shared with usr C
4. User A removes the sharing from both users at project level.
5. Both users cannot view the project now.
6. Both users can see the cloned experiment in Experiment Browse but cannot view the experiment details. Throws exception attached

First if using owners project to create experiments should not be able to remove the owner from the experiment or the project
Secondly if permission is denied should handle with correct error messages.

TODO

• Add the notion of an indirect or cascading owner to the sharing dialog and display them like the project_owner.png screenshot attached
• also show the indirect owner in the display of shared with users

Issue Links

• depends upon: AIRAVATA-2185 Add OWNER ResourcePermissionType to sharing API
• is related to: AIRAVATA-3030 Add project entity sharing details to sharing button
• relates to: AIRAVATA-2217 Sharing service should prevent removing sharing of experiments from the project's owner
• links to: GitHub Pull Request #47