1088191 - Allow flag requestee to be a numeric user id

Status: NEW

(bugzilla.mozilla.org :: API, enhancement)

Description

[Gregory Szorc [:gps]]

When interacting with flag data in attachments through the Bugzilla API, the requestee field must be a login name (email address). e.g. http://www.bugzilla.org/docs/tip/en/html/api/Bugzilla/WebService/Bug.html#add_attachment.

For external systems that derive their user data from Bugzilla (such as MozReview), this is sub-optimal, as login names can and do change. These external systems prefer to speak in terms of constant identifiers (user ids) because it eliminates problems with data being out of sync. For example, when MozReview updates the requestee on an attachment, it must first verify with Bugzilla that the Bugzilla login / email address is current. Otherwise, it may inadvertently send a value that has changed. This adds an extra API call and introduces a vector for user impersonation and potentially inadvertent user disclosure.

I would like to request that the Bugzilla API accept constant, numeric user ids in the requestee field.

This request is a subset of a larger request (which I'm not going to file) of "all Bugzilla API fields should talk in terms of constant identifiers, not things that can change over time." This likely means using numeric IDs everywhere.

Comment 1

[:glob ✱]

this is probably a WONTFIX.

none of our existing API deals with IDs.  i agree that they should, but i don't think that adding it in a piecemeal fashion to the current API is a useful allocation of resources.

we already have plans to design a new REST api from scratch in order to deliver an API that is more RESTful, consistent, and sane.  designing "name or id" support into that from the start is an excellent idea.