diff --git a/src/main/java/org/alfresco/rest/api/impl/GroupsImpl.java b/src/main/java/org/alfresco/rest/api/impl/GroupsImpl.java index 22e824404e..0a875fae18 100644 --- a/src/main/java/org/alfresco/rest/api/impl/GroupsImpl.java +++ b/src/main/java/org/alfresco/rest/api/impl/GroupsImpl.java @@ -58,6 +58,7 @@ import org.alfresco.rest.api.model.GroupMember; import org.alfresco.rest.framework.core.exceptions.ConstraintViolatedException; import org.alfresco.rest.framework.core.exceptions.EntityNotFoundException; import org.alfresco.rest.framework.core.exceptions.InvalidArgumentException; +import org.alfresco.rest.framework.core.exceptions.NotFoundException; import org.alfresco.rest.framework.core.exceptions.PermissionDeniedException; import org.alfresco.rest.framework.core.exceptions.UnsupportedResourceOperationException; import org.alfresco.rest.framework.resource.parameters.CollectionWithPagingInfo; @@ -809,7 +810,15 @@ public class GroupsImpl implements Groups } validateGroupMemberId(groupMemberId); - // TODO: Verify if groupMemberId is member of groupId + + // Verify if groupMemberId is member of groupId + AuthorityType authorityType = AuthorityType.getAuthorityType(groupMemberId); + Set parents = authorityService.getContainingAuthorities(AuthorityType.GROUP, groupMemberId, true); + if (!parents.contains(groupId)) + { + throw new NotFoundException(groupMemberId + " is not member of " + groupId); + } + authorityService.removeAuthority(groupId, groupMemberId); } diff --git a/src/test/java/org/alfresco/rest/api/tests/GroupsTest.java b/src/test/java/org/alfresco/rest/api/tests/GroupsTest.java index 117027fa63..cd797b77d1 100644 --- a/src/test/java/org/alfresco/rest/api/tests/GroupsTest.java +++ b/src/test/java/org/alfresco/rest/api/tests/GroupsTest.java @@ -1780,6 +1780,11 @@ public class GroupsTest extends AbstractSingleNetworkSiteTest groupsProxy.deleteGroupMembership(GROUP_EVERYONE, groupMemberA.getId(), HttpServletResponse.SC_CONFLICT); } + // Removing a group that is not a member (REPO-1943) + { + groupsProxy.deleteGroupMembership(groupB.getId(), personMember.getId(), HttpServletResponse.SC_NOT_FOUND); + } + // Authentication failed { setRequestContext(networkOne.getId(), GUID.generate(), "password"); @@ -1788,8 +1793,10 @@ public class GroupsTest extends AbstractSingleNetworkSiteTest // User does not have permission to delete a group membership { + setRequestContext(networkOne.getId(), networkAdmin, DEFAULT_ADMIN_PWD); + groupsProxy.createGroupMember(groupA.getId(), personMember, HttpServletResponse.SC_CREATED); setRequestContext(user1); - groupsProxy.deleteGroupMembership(groupA.getId(), groupMemberA.getId(), HttpServletResponse.SC_FORBIDDEN); + groupsProxy.deleteGroupMembership(groupA.getId(), personMember.getId(), HttpServletResponse.SC_FORBIDDEN); } } finally