Bug 2065173 - Migrate Group REST resource to native Mojo API by Xzzz · Pull Request #2745 · mozilla/bmo

Xzzz · 2026-09-15T15:10:32Z

Summary

Ports Bugzilla::WebService::Group's create/update/get methods into a native Bugzilla::API::V1::Group Mojo controller, mirroring the pattern already used for Classification/Component/Teams/Reminders/Configuration/Bugzilla (system info)/BugUserLastVisit/Product.

This is a child bug of 2057358, see there for details.

Master has been merged in now that #2751, #2756 and #2743 have landed, so the branch no longer carries its own copy of merge_request_params or the i_am_webservice change; both come from master and Bugzilla/Util.pm has dropped out of this diff. The WS_DISPATCH conflict with #2743 is resolved by dropping both entries: master removed BugUserLastVisit, this PR removes Group.

Master was merged in again after #2762 (Product) landed: the same conflict in WS_DISPATCH, REST.pm's use list and WebService.pm's POD is resolved by dropping both entries, Product (master) and Group (this PR).

Changes

Add Bugzilla/API/V1/Group.pm: GET/POST /rest/group and GET/PUT /rest/group/<id_or_name> (login + creategroups required for create/update), same JSON response shape as the legacy endpoints
Delete Bugzilla/WebService/Group.pm and Bugzilla/WebService/Server/REST/Resources/Group.pm
Remove the Group entry from WS_DISPATCH in Bugzilla/WebService/Constants.pm, the corresponding use line in Bugzilla/WebService/Server/REST.pm, and the POD entry in Bugzilla/WebService.pm
create/update/get unpack ($params, $error) from the shared merge_request_params and report a malformed JSON body as rest_malformed_json, instead of the decode error being swallowed
update() and get() declare ids and names as list parameters, so ?ids=1&ids=2 returns every group asked for rather than only the last. create() takes only scalar fields and is left alone
update() deletes the request-level keys (ids, names, include_fields, exclude_fields, Bugzilla_api_key, Bugzilla_api_token, Bugzilla_login, Bugzilla_password) and passes the rest to set_all(), so an unrecognized field still raises unknown_method rather than being silently dropped
The allowed methods for OPTIONS come from the route, so /rest/group advertises GET, POST and /rest/group/<id_or_name> advertises GET, PUT, rather than one shared GET, POST, PUT for both. Access-Control-Allow-Methods follows the same value
_get_group_membership(): normalise an empty visible_groups_inherited to undef. An empty arrayref is truthy, so the group_not_visible check passed and the query became SELECT userid FROM profiles AND ugm.group_id IN (...), a SQL error. Carried over from the legacy code
qa/t/rest_group_get.t: cover a repeated ids parameter, and a user who can bless one group and requests another

Breaking change: removing the WS_DISPATCH entry also removes Group.create/update/get from JSON-RPC and XML-RPC, not just the legacy REST dispatcher, since all three share that table. Native Mojo routes only serve REST. This matches the same tradeoff already made in the Classification, Bugzilla (system-info), BugUserLastVisit and Product migrations earlier in this series.

Pre-existing bug, fixed here: get()'s "filter by blessability" step for non-can_see_groups users. An earlier revision of this description claimed the legacy code was a no-op filter preserved as-is; both halves of that were wrong. Legacy ran [map { $user->can_bless($_) } @{$groups}] (a map, not a grep) and can_bless expects a group id, so passing the object numified the ref and returned 0 for every element. _group_to_hash then called ->id on 0, meaning GET /rest/group/<id> as a blesser without can_see_groups returned a 500. Passing $_->id to a grep filters the list as the comment always claimed. This is a real behaviour change: those users now get a filtered list instead of an error, and qa/t/rest_group_get.t covers it.

Test plan

GET /rest/group / GET /rest/group?ids=1&ids=2 / GET /rest/group?names=admin
GET /rest/group/<id> / GET /rest/group/<name>
GET /rest/group/<id>?membership=1
GET /rest/group/<id> as a user who can bless a different group, expecting a filtered list rather than a 500
POST /rest/group (name/description required, duplicate name, invalid user_regexp)
POST/PUT with a malformed JSON body, expecting rest_malformed_json
PUT /rest/group/<id_or_name> with an unrecognized field, expecting unknown_method rather than an empty changes
PUT /rest/group/<id_or_name> (protected admin/insider group rejected for non-admins, per qa/t/rest_group_update_protected.t)
OPTIONS /rest/group returns Allow: GET, POST, OPTIONS /rest/group/<id_or_name> returns Allow: GET, PUT
qa/t/rest_group_create.t and qa/t/rest_group_update_protected.t pass unchanged; qa/t/rest_group_get.t gains the repeated-ids and blessability cases

References

Bugzilla link: 2065173
Part of 2057358
Bug 2074854 - Recognize USAGE_MODE_MOJO_REST as a webservice mode in i_am_webservice #2756, Bug 2065171 - Migrate BugUserLastVisit REST resource to native Mojo API #2743 and Bug 2071907 - Migrate Product REST resource to native Mojo API #2762 have landed; the i_am_webservice change and the list-parameter support both come from master

Error messages from native-Mojo REST controllers were being word-wrapped at 72 columns, introducing literal newlines that broke message-content assertions like rest_group_create.t.

…failure The 'auth_failure' error template only has a branch for 'groups' (plural), 'group' fell through to the empty default, so the unauthorized-user message read "...not authorized to add new ." with the object word missing.

_request_params duplicated the same query-string/JSON-body merge logic already written for BugUserLastVisit.pm (bug 2065171). Now call a single shared merge_request_params helper, so it's a one-place change to drop later if query-string-on-POST support is ever removed. Please note that BugUserLastVisit.pm (bug 2065171) is being updated separately to call the same helper instead of its own copy.

Xzzz · 2026-09-17T13:40:35Z

Pushed a follow-up commit extracting _request_params's merge logic into a shared Bugzilla::WebService::Util::merge_request_params helper, reused by BugUserLastVisit.pm (bug 2065171, PR #2743) as well.
Group's _request_params had no extra per-field handling, so it's now just a direct call to the shared helper.
=> No behavior change

can_bless() takes a group id, not a Group object. Passing the object made every entry falsy, and the next line's ->id call on that died. Reachable by bless-privileged users without can_see_groups. Was ported faithfully from legacy as a described no-op, although it's actually a genuine crash, so fixing it here.

…/ids set_all() throws unknown_method for any stray key without a matching set_<key> method. Cookie-authenticated PUT hit this via Bugzilla_api_token (legacy deleted it before the method ran, the Mojo cookie-auth path doesn't), include_fields/exclude_fields hit it too. Whitelist the update fields instead.

dklawren · 2026-09-18T20:46:44Z

+
+  if (length $c->req->body) {
+    my $body_params;
+    try { $body_params = decode_json($c->req->body); }


swallowing the decode error is a regression from the legacy layer. _retrieve_json_params in Bugzilla/WebService/Server/REST.pm:343 did ThrowUserError('json_rpc_invalid_params', {err_msg => $@})

so POST /rest/group with a truncated body now reports You must enter a name instead of telling the client its JSON is broken

suggest rethrowing as json_rpc_invalid_params when the body is non-empty and looks like JSON. separately, the length $c->req->body guard has no method check, so a GET with a body gets its JSON merged in too - legacy only did this for non-GET

The first half is fixed. Since #2751 landed, the shared merge_request_params in master returns ($params, $error) and raises rest_malformed_json instead of swallowing the decode failure, and create/update/get now unpack both and report it, so a truncated body no longer surfaces as You must enter a name.

The second half is still open, and I would rather have your call than decide it here. You are right that the guard has no method check: it is length $body && !@{$c->req->body_params->names}, so a GET carrying a JSON body still gets it merged, while legacy only merged the body for non-GET requests (Bugzilla/WebService/Server/REST.pm:337).

The catch is that the guard now lives in master and is shared by BugUserLastVisit, Group, Component and Reminders, so fixing it here would put a cross-cutting change back inside a migration PR, which is what you asked me to avoid on the i_am_webservice one. Three options as I see them:

fold it into Bug 2065171 - Migrate BugUserLastVisit REST resource to native Mojo API #2743, which already touches that helper and is waiting on review

give it its own bug the way we did for 2074854

leave it and I will file it separately

Which would you prefer?

The shared helper landed in master with a two-element return, so calling it in scalar context assigned the error rather than the params. create/update/get now unpack both and report a malformed JSON body via user_error.

Whitelisting the documented fields made a typo or an unsupported field a silent no-op returning 200 with empty changes. Delete the request-level keys and pass the rest to set_all(), which still raises unknown_method.

Both OPTIONS routes shared one Allow value, so /rest/group advertised PUT and /rest/group/<id> advertised POST, neither of which exists. The allowed methods now come from the route, which also fixes Access-Control-Allow-Methods.

The legacy code mapped rather than grepped can_bless($group_object), so every element became 0 and _group_to_hash called ->id on it: a 500 for a blesser without can_see_groups, not the no-op the comment claimed.

An empty arrayref is truthy, so the group_not_visible check passed and the membership query became a bare SELECT with an ' AND ...' appended, which is a SQL error. Carried over from the legacy code.

merge_request_params collapses parameters to scalars unless the caller says otherwise, so ?ids=1&ids=2 returned only the last group. update() and get() now declare both list parameters; create() takes only scalar fields and is left alone. Covers the repeated form, which no test exercised.

# Conflicts: # Bugzilla/WebService.pm # Bugzilla/WebService/Constants.pm # Bugzilla/WebService/Server/REST.pm

…), with test

…th test

…date, with test

dklawren · 2026-10-09T18:37:13Z

+  my %values = %$params;
+  delete @values{
+    qw(ids names include_fields exclude_fields
+      Bugzilla_api_key Bugzilla_api_token Bugzilla_login Bugzilla_password


Bugzilla_token (and Bugzilla_restrictlogin/restrictlogin) are not dropped here, so a client still sending a legacy token param now gets unknown_method from set_all() where the old code stripped it during login

Looking back on other PRs that we do this and will do for others in the future, maybe we should make this a utility method for Util.pm and backfill the other migration code to use it as well. Bonus points to put the delete list in a constant maybe in Util.pm.

Xzzz added 3 commits September 15, 2026 17:05

Bug 2065173 - Migrate Group REST resource to native Mojo API

060d6a8

Bug 2065173 - Fix i_am_webservice() to recognize USAGE_MODE_MOJO_REST

740a663

Error messages from native-Mojo REST controllers were being word-wrapped at 72 columns, introducing literal newlines that broke message-content assertions like rest_group_create.t.

dklawren requested changes Sep 16, 2026

View reviewed changes

Comment thread Bugzilla/API/V1/Group.pm Outdated

Comment thread Bugzilla/API/V1/Group.pm

Comment thread Bugzilla/API/V1/Group.pm Outdated

Comment thread Bugzilla/API/V1/Group.pm Outdated

Xzzz added 2 commits September 17, 2026 14:52

Merge remote-tracking branch 'origin/master' into bug-2065173

20194f1

Xzzz added 4 commits September 17, 2026 16:54

Bug 2065173 - Use relaxed #id placeholder to allow dots in group names

26c885e

Bug 2065173 - Preserve null in changes when a field goes to/from undef

44d1ec9

dklawren requested changes Sep 18, 2026

View reviewed changes

This was referenced Sep 23, 2026

Bug 2074854 - Recognize USAGE_MODE_MOJO_REST as a webservice mode in i_am_webservice #2756

Merged

Bug 2065171 - Migrate BugUserLastVisit REST resource to native Mojo API #2743

Merged

Xzzz added 9 commits September 23, 2026 21:19

Merge remote-tracking branch 'origin/master' into bug-2065173

a0fe532

Bug 2065173 - Correct the blessability comment and cover the fixed case

c0b0db2

The legacy code mapped rather than grepped can_bless($group_object), so every element became 0 and _group_to_hash called ->id on it: a 500 for a blesser without can_see_groups, not the no-op the comment claimed.

Bug 2065173 - Treat an empty visible group list as no visible groups

9eaf66e

An empty arrayref is truthy, so the group_not_visible check passed and the membership query became a bare SELECT with an ' AND ...' appended, which is a SQL error. Carried over from the legacy code.

Merge remote-tracking branch 'origin/master' into bug-2065173

381c8f3

Merge remote-tracking branch 'origin/master' into bug-2065173

7cacefc

Xzzz requested a review from dklawren September 23, 2026 21:57

Merge remote-tracking branch 'origin/master' into bug-2065173

d841e36

# Conflicts: # Bugzilla/WebService.pm # Bugzilla/WebService/Constants.pm # Bugzilla/WebService/Server/REST.pm

dklawren requested changes Oct 5, 2026

View reviewed changes

Comment thread Bugzilla/API/V1/Group.pm

Comment thread qa/t/rest_group_get.t

Xzzz added 3 commits October 8, 2026 10:45

Merge remote-tracking branch 'origin/master' into bug-2065173

ecd3e41

Bug 2065173 - Drop api_key, login, password and token before set_all(…

e81a7fd

…), with test

Bug 2065173 - Assert a blesser still gets the group they can bless

4505b0a

Xzzz requested a review from dklawren October 8, 2026 10:03

dklawren requested changes Oct 8, 2026

View reviewed changes

Comment thread Bugzilla/API/V1/Group.pm Outdated

Comment thread Bugzilla/API/V1/Group.pm

Xzzz added 2 commits October 9, 2026 19:15

Bug 2065173 - Use stash('id') for the path id in Group get/update, wi…

033ea62

…th test

Bug 2065173 - Accept only true/false for is_active in Group create/up…

a3ee62d

…date, with test

Xzzz requested a review from dklawren October 9, 2026 18:09

dklawren requested changes Oct 9, 2026

View reviewed changes

Navigation Menu

Repository navigation

Bug 2065173 - Migrate Group REST resource to native Mojo API - #2745

Bug 2065173 - Migrate Group REST resource to native Mojo API#2745
Xzzz wants to merge 24 commits into
mozilla:masterfrom
Xzzz:bug-2065173

Xzzz commented Sep 15, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Xzzz commented Sep 17, 2026

Uh oh!

Uh oh!

dklawren Sep 18, 2026

Uh oh!

Xzzz Sep 23, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

dklawren Oct 9, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

Xzzz commented Sep 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Test plan

References

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Xzzz commented Sep 17, 2026

Uh oh!

Uh oh!

dklawren Sep 18, 2026

Choose a reason for hiding this comment

Uh oh!

Xzzz Sep 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

dklawren Oct 9, 2026

Choose a reason for hiding this comment

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Xzzz commented Sep 15, 2026 •

edited

Loading

Xzzz Sep 23, 2026 •

edited

Loading