Unnecessary "View users created by other users" permission required for connection

Created on 27 February 2025, 3 months ago

Problem/Motivation

In order to test the connection, which is required before the plugin can be used, the `checkMemsourceConnection` method is called, which queries the `api2/v1/users` endpoint. It seems there have recently been changes to the Phrase TMS API that result in this endpoint returning 403 errors if the current user lacks the "View users created by other users" permission (previously, a 200 response was returned, with a filtered list containing only users that the current user had permission to view).

As an LSP, adding the "View users created by other users" permission to our customer's account isn't a satisfactory solution, as it allows them to view potentially sensitive data (e.g. email addresses) of our other customers.

Steps to reproduce

1. In Phrase, create a user with `PROJECT_MANAGER` role but lacking the fine-grained "View users created by other users" permission.
2. In TMGMT, attempt to set up a `phrase` provider that connects via that user.
3. Upon attempting to connect, observe the error message: "Please check your login credentials and try to connect again."

Proposed resolution

One or both of the following:
1. Call `/api2/v1/auth/whoAmI` endpoint instead, which requires no special permissions.
2. Revert the Phrase TMS API change to returning a 200 with a filtered (possibly empty) list of users if "View users created by other users" permission is lacking.

🐛 Bug report
Status

Active

Version

1.0

Component

Code

Created by

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

Production build 0.71.5 2024