A user, typeoneerror, encountered an issue when attempting to create groups via the Discourse API. They were trying to assign an owner to the group using the owner_usernames parameter, which they believed was optional. However, they received an error indicating that this parameter was not whitelisted.
After further investigation, typeoneerror discovered that the issue might not be with the parameter itself, but rather with how the group ownership is assigned in the Discourse code. They suspected that the group_users relationship is not being persisted when creating a group.
However, in their third post, typeoneerror realized that the issue was actually due to the format of the owner_usernames parameter. Instead of passing an array, it should be a comma-delimited string. They apologized for the false report and clarified that the correct format is the same as the usernames parameter, which should be a comma-separated string.
NOTE: please see my second post below for the real issue.
I am attempting to programatically create groups via the DiscourseApi (ruby gem). The Groups module seems to indicate that owner_usernames is an optional param:
and I’m passing it through as:
owner_usernames: ['ben']
However the actual request to Discourse is not working because that parameter is not a whitelisted parameter:
Processing by Admin::GroupsController#create as JSON
Parameters: {"group"=>{"full_name"=>"Super Test Group", "mentionable_level"=>"3", "messageable_level"=>"3", "name"=>"super-test-group", "owner_usernames"=>["ben"], "visibility_level"=>"1"}, "api_key"=>"[FILTERED]", "api_username"=>"ben"}
Unpermitted parameter: :owner_usernames.
Is this intentional/by design or should I submit a PR to allow owner_usernames to be mass-assigned? For my integration’s purpose, I need the group to be “owned” by the username making the API request.
Now that I’m looking at Discourse, I see where the owner_ids should be being assigned. Still looking at what user_groups.build does and where that relationship actually gets saved. I may be misunderstanding it, but it appears that those relationships are never saved, only the group.save is called whereas the group_users are only built [build]. Does group.save actually call throught to group.group_users to persist the relationships?
It may be that this use-case was missed because most folks create a group first and then assign an owner to it. In this case the group is already persisted and you’re then using add_owners?
If this is the bug I think it is, this would also apply to adding group users (not just owners) within the #create method.