Sites aren't visible to users with the aegir client role through the sites tab (hosting/sites). Presently, the only way for a client to view/edit their sites is to find a task in the queue runner about their site and click through from there.

A similar situation exists in the platforms tab - users with the 'aegir client' role aren't able to see any platforms.

On hostings/sites, the view is checking that the client id is able to view the site & platform & client & dbserver & install profile package. The default grants permit an aegir client to see the site, install profile package, and client. However, since the aegir client doesn't have permission to view the platform or dbserver the entire select returns an empty list. The view hosting platform is not granted though 'view platform' is assigned to the 'aegir client' role by default (rebuilding node access permissions doesn't change anything). 'aegir clients' do not have the 'view server' permission, though once granted they are able to see the servers through the server tab.

CommentFileSizeAuthor
#2 hosting-2883695-aegir_client_may_not_see_sites_and_platforms-0.patch2.83 KBkienan
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

kienan created an issue. See original summary.

kienan’s picture

kienan CreditAttribution: kienan commented
FileSize
hosting-2883695-aegir_client_may_not_see_sites_and_platforms-0.patch2.83 KB

Here's a patch that resolves the issue. There are a few points it addresses:

  • clients were never given access to platforms when no clients were added to the platform. The UI indicates that all clients should have access if none are entered
  • in hosting_client_node_grants, if 'view server' isn't granted to the user, the realm is never created.
  • node_access is rebuilt in the update hook

The consequence of this change is that users may now see sites, platforms, and web- and database-servers associated with those platforms. While I wonder if viewing the servers is desired, I think this is more in line with what is intended to happen.

kienan’s picture

kienan CreditAttribution: kienan commented
Status: Active » Needs review
helmo’s picture

helmo CreditAttribution: helmo at Initfour websolutions commented

Thanks al lot ... first test looks very good.

helmo’s picture

helmo CreditAttribution: helmo at Initfour websolutions commented

Something to add to the release notes .... "This update hook uses a batch to rebuild the node_access information, depending on the system size you'll see hosting_client_update_7001 repeated for a while."

Performed update: hosting_client_update_7001 [ok]
Performed update: hosting_client_update_7001 [ok]
Performed update: hosting_client_update_7001 [ok]

kienan’s picture

kienan CreditAttribution: kienan commented

Documentation PR: https://github.com/aegir-project/documentation/pull/42

helmo’s picture

helmo CreditAttribution: helmo at Initfour websolutions commented
Status: Needs review » Reviewed & tested by the community

  • helmo committed 812ea9f on 7.x-3.x authored by kienan 
    Issue #2883695 by kienan: Users with the aegir client role not able to...
helmo’s picture

helmo CreditAttribution: helmo at Initfour websolutions commented
Status: Reviewed & tested by the community » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.