Enhance project ACL handling and add tests for permission deletion on new projects

Author: BryanFauble

synapseclient/models/mixins/access_control.py

@@ -235,7 +235,10 @@ async def delete_permissions_async(
         determined by its own ACL.
 
         If the ACL of an Entity is deleted, then its benefactor will automatically be set
-        to its parent's benefactor. The ACL for a Project cannot be deleted.
+        to its parent's benefactor.
+
+        **Special notice for Projects:** The ACL for a Project cannot be deleted, you
+        must individually update or revoke the permissions for each user or group.
 
         Arguments:
             include_self: If True (default), delete the ACL of the current entity.
@@ -411,6 +414,9 @@ async def _delete_current_entity_acl(
             Exception: For any other errors that may occur during deletion.
         """
         if not entity_info["is_target_type"] and entity_info["entity_type"] is not None:
+            client.logger.debug(
+                f"Skipping ACL deletion for entity {self.id} as its type '{entity_info['entity_type']}' does not match the target types."
+            )
             return
 
         try:

synapseclient/models/protocols/access_control_protocol.py

@@ -183,7 +183,10 @@ def delete_permissions(
         determined by its own ACL.
 
         If the ACL of an Entity is deleted, then its benefactor will automatically be set
-        to its parent's benefactor. The ACL for a Project cannot be deleted.
+        to its parent's benefactor.
+
+        **Special notice for Projects:** The ACL for a Project cannot be deleted, you
+        must individually update or revoke the permissions for each user or group.
 
         Arguments:
             include_self: If True (default), delete the ACL of the current entity.

tests/integration/synapseclient/models/async/test_permissions_async.py

@@ -859,4 +859,23 @@ async def test_delete_permissions_invalid_entity_type(
         # AND the error message should mention allowed values
         assert "Invalid entity type" in str(exc_info.value)
         assert "folder" in str(exc_info.value)
-        assert "file" in str(exc_info.value)
+
+    async def test_delete_permissions_on_new_project(
+        self, caplog: pytest.LogCaptureFixture
+    ) -> None:
+        """Test deleting permissions on a newly created project."""
+        # GIVEN a newly created project with custom permissions
+        project = await Project(name=f"test_project_{uuid.uuid4()}").store_async()
+        self.schedule_for_cleanup(project.id)
+
+        # AND custom permissions are set for authenticated users
+        await self._set_custom_permissions(project)
+
+        # WHEN I delete permissions on the project
+        await project.delete_permissions_async()
+
+        # THEN the permissions should not be deleted
+        assert (
+            "Cannot restore inheritance for resource which has no parent."
+            in caplog.text
+        )

tests/integration/synapseclient/models/synchronous/test_permissions.py

@@ -850,3 +850,23 @@ async def test_delete_permissions_invalid_entity_type(
         assert "Invalid entity type" in str(exc_info.value)
         assert "folder" in str(exc_info.value)
         assert "file" in str(exc_info.value)
+
+    async def test_delete_permissions_on_new_project(
+        self, caplog: pytest.LogCaptureFixture
+    ) -> None:
+        """Test deleting permissions on a newly created project."""
+        # GIVEN a newly created project with custom permissions
+        project = await Project(name=f"test_project_{uuid.uuid4()}").store_async()
+        self.schedule_for_cleanup(project.id)
+
+        # AND custom permissions are set for authenticated users
+        await self._set_custom_permissions(project)
+
+        # WHEN I delete permissions on the project
+        await project.delete_permissions()
+
+        # THEN the permissions should not be deleted
+        assert (
+            "Cannot restore inheritance for resource which has no parent."
+            in caplog.text
+        )