Possible bug when editing user's username property

[tcompa]

(found with @marcodeltufo)

To reproduce:

1. Go to localhost:5173/admin/users
2. Edit a user who already has a given value for username
3. Remove the value of username and click "save".
4. No error is observed
5. The user still has the same username.

Note that the request body of the PATCH API call is

{
"id":1,
"email":"[email protected]",
"is_active":true,
"is_superuser":true,
"is_verified":false,
"slurm_user":"test01",
"cache_dir":"/tmp \\asd"
}

but it does not include username.

---

Is something wrong here? Or did we exclude it on purpose due to some weird request-body-validation rule in fractal-server? (cc @ychiucco)

[tcompa]

Addendum: when instead of removing the current value we replace it with a different string, the PATCH goes through and the change takes place.
Therefore I guess we introduced some fractal-web logic to avoid sendind a request with username=null to the fractal-server PATCH endpoint, most likely because it would not be accepted.

[tcompa]

My suggestions:

1. It is a bit weird that this property is removed from the payload without any warning/error message, in fractal-web.
2. This username change looks like something that an admin should be able to do. If they can modify a user's username, then they should also be able to remove it. This likely requires a (minor) change in fractal-server. Note: I may be contradicting past me, with this remark.. if so, I'm sorry for that ;)

[ychiucco]

Currently we do not accept None as UserUpdate.username, but we can make it possible by changing this line
https://github.com/fractal-analytics-platform/fractal-server/blob/673e1c95b7de9b6f0a54f97eaf080ea80abdd569/fractal_server/app/schemas/user.py#L52C1-L52C8
into
_username = validator("username", allow_reuse=True)(valstr("username", accept_none=True))

[zonia3000]

I confirm that in the frontend we are removing the null values. If I allow them I receive:

String attribute 'username' cannot be None

[tcompa]

Waiting for backend

• Should we accept username=None in UserUpdate schema? fractal-server#1650

[tcompa]

Closing, as the use of username should be superseded by the future task access-control configuration (based on either task-user relationship or task-user_group relationship, and not on string matching for specific columns).
Specific backend issue(s) TBD