Enable users to call the add-member API

[seanh]

h's add-member-to-group API can only be called by authclients, not users, even though other membership APIs (list members, edit-membership, remove-membership) can all be called by users.

This PR enhances the add-membership API to allow it to be called by users as well as authclients.

This PR doesn't update the API docs, I'll send a follow-up PR to do that.

Testing

1. Log in as devdata_admin (password: pass).

2. Go to http://localhost:5000/groups/new and create a new group.

3. Go to http://localhost:5000/account/developer and create an API key.

4. Use the API key to authenticate a request to the add-member API:

   $ httpx http://localhost:5000/api/groups/{pubid}/members/acct:devdata_user@localhost --method POST --headers Authorization 'Bearer {apikey}
   

[seanh]

So the MEMBER_ADD permission will be granted if either group_member_add() returns True or group_matches_authenticated_client_authority() returns True.

If you're wondering what this "permission map" is DD: Group Owners, Admins and Moderators contains a section explaining how security permissions work in Pyramid and h.

[seanh]

Now that the add-member API can be called by users we need this need security permissions predicate function to check that the authenticated user should be permitted to make the request: to add a user to a group with role "owner" or "admin" the authenticated user must be a member of the group also with role "owner". Or, if the authenticated user has role "admin", they can add a user with role "member" or "moderator". If you're not an owner or admin of a group then you're not allowed to add users to that group with any role.

(This predicate wasn't needed previously because the add-member API could only be called by authclients and authclients are permitted to do anything.)

The get_authenticated_users_roles() helper has been duplicated a few times now, I'll send a follow-up PR to refactor and deduplicate this and other duplication in predicates.py (#9205).

Copilot reviewed 5 out of 9 changed files in this pull request and generated no suggestions.

Files not reviewed (4)

• h/security/predicates.py: Evaluated as low risk
• h/services/group_members.py: Evaluated as low risk
• h/views/api/group_members.py: Evaluated as low risk
• tests/functional/api/groups/members_test.py: Evaluated as low risk

[mtomilov]

Tested it locally seems to be working just fine.