Scope of can_configure permission in CHT

jonathan · April 22, 2022, 8:21am

I am trying to create a non-admin user with the can_configure permission to push configuration thru cht-conf. I’ve found that this user can push app-settings but when it comes to other config e.g translations, forms, it fails with error 401 unauthorized.
I was hoping that the can_configure permission would allow a user to do this.

gareth · April 24, 2022, 7:18pm

To help me work out what’s going on here it would be useful to know exactly which request is failing, for example, uploading translations makes several requests to complete the action. Could you provide the full output of running the command, including the successful steps and the stacktrace?

Also, does the user have any other permissions, or is it just can_configure and nothing else?

diana · April 26, 2022, 3:24pm

I think the edits to translations and forms is blocked by validate_doc_update:

github.com

medic/cht-core/blob/52605ac752bb40ab61ee1198fd7fe1bc0fbef982/ddocs/medic/validate_doc_update.js#L12-L21


      
          var ADMIN_ONLY_TYPES = [ 'form', 'translations', 'token_login' ];
          var ADMIN_ONLY_IDS = [
            'resources',
            'service-worker-meta',
            'zscore-charts',
            'settings',
            'branding',
            'partners',
            'privacy-policies',
          ];

Only couchdb admins can edit these types of docs.

diana · April 26, 2022, 3:26pm

To avoid this, I think API endpoints should be used for each of these actions, instead of accessing CouchDb directly with the user provided to cht-conf.