1074947 - [buddyup] API to edit user profiles

Status: RESOLVED FIXED

(support.mozilla.org :: Users and Groups, task, P2)

Description

[Michael Cooper [:mythmon]]

Clients should be able to edit user profiles via the API. A user should be able to edit their own profile. Some users should be able to edit other users' profiles.

Outstanding questions

* Who can edit other users' profiles? Admins? Mods? Superusers only?
* Do we need to add any new fields to the user profiles to support Buddyup user profiles? (These should probably be more bugs).

Comment 1

[Michael Cooper [:mythmon]]

This should be easy. 1pt.

Comment 2

[Kadir Topal [:atopal]]

(In reply to Mike Cooper [:mythmon] from comment #0)
> Clients should be able to edit user profiles via the API. A user should be
> able to edit their own profile. Some users should be able to edit other
> users' profiles.
> 
> Outstanding questions
> 
> * Who can edit other users' profiles? Admins? Mods? Superusers only?

I'd say moderators and higher, as per bug 1048119. Looping in Madalina to be sure, but that should not be blocking.

> * Do we need to add any new fields to the user profiles to support Buddyup
> user profiles? (These should probably be more bugs).

Yeah, we need at least two more fields: preferred operator, preferred handset as per bug 1074989

Comment 3

[Ricky Rosario [:rrosario, :r1cky]]

(In reply to Mike Cooper [:mythmon] from comment #0)
> * Who can edit other users' profiles? Admins? Mods? Superusers only?

It should be whatever we implement in bug 1048119. I am pretty sure it will be all users with users.edit_profile permission or similar. Then this will be assigned to the pertinent groups.

Comment 4

[Ricky Rosario [:rrosario, :r1cky]]

This needs to move to the next sprint. Didn't make it here.

Comment 5

[Anthony Ricaud (:rik)]

If it makes it faster to implement, we can start by only allowing the current user to update their profile. This is the only part needed for Buddyup. And open a followup bug for the users with higher privileges.

Comment 6

[Anthony Ricaud (:rik)]

Per an email thread, reminder that we need to get the user's avatar as part of this API. (setting it is out of scope for now)

Comment 7

[Michael Cooper [:mythmon]]

PR: https://github.com/mozilla/kitsune/pull/2195

Landed: https://github.com/mozilla/kitsune/commit/72490539c7b1c552d21672e155d8fcae26ab6792

Ricky pushed this to stage earlier.

Comment 8

[Anthony Ricaud (:rik)]

Apparently this API requires us to send the username and password. Given that we already send the token, this sounds redundant. Is there a reason for this?

Comment 9

[Michael Cooper [:mythmon]]

The username and password here aren't be asked for authorization, but as required fields to update the user. That's not needed, it's a mistake in the API. I'll fix that up today.

Comment 10

[Schalk Neethling [:espressive]]

Hey Mike,

On the profile we are missing two fields:

1) handset_type, which will be an array
2) operator

Can you add these or, should I store these in settings?

Comment 11

[Schalk Neethling [:espressive]]

Mike on second thought, it actually makes total sense to store those values in settings.

Comment 12

[Michael Cooper [:mythmon]]

I agree, these should be a part of settings.