From cbc8b5f6442143a40b106b60c52ba7ebf604c023 Mon Sep 17 00:00:00 2001
From: Aurélien Bompard <aurelien@bompard.org>
Date: Nov 06 2017 09:26:52 +0000
Subject: Fix hub members edition


---

diff --git a/hubs/tests/views/test_api_hub_config.py b/hubs/tests/views/test_api_hub_config.py
index b542ce1..c2e1b44 100644
--- a/hubs/tests/views/test_api_hub_config.py
+++ b/hubs/tests/views/test_api_hub_config.py
@@ -5,7 +5,7 @@ import datetime
 from flask import json
 
 from hubs.app import app
-from hubs.models import Hub, User
+from hubs.models import Hub, User, Association
 from hubs.tests import APPTest, FakeAuthorization, auth_set
 
 
@@ -131,6 +131,43 @@ class TestAPIHubConfig(APPTest):
         hub_config = Hub.query.get("decause").config
         self.assertEqual(hub_config.summary, "Decause")
 
+    def test_put_users(self):
+        hub = Hub.by_name('ralph')
+        for username in ["devyani7", "dhrish"]:
+            hub.associations.append(
+                Association(user=User.query.get(username), role="member")
+            )
+        hub.associations.append(
+            Association(user=User.query.get("shalini"), role="subscriber")
+        )
+        user = FakeAuthorization('ralph')
+        with auth_set(app, user):
+            result = self.app.put(
+                '/api/hubs/ralph/config',
+                content_type="application/json",
+                data=json.dumps({
+                    "users": {
+                        "owner": [{"username": "ralph"}],
+                        "member": [
+                            {"username": "decause"},
+                            {"username": "dhrish"},
+                        ],
+                    }
+                })
+            )
+        self.assertEqual(result.status_code, 200)
+        result_data = json.loads(result.get_data(as_text=True))
+        self.assertEqual(result_data["status"], "OK")
+        self.assertListEqual(
+            [(a.user_id, a.role) for a in hub.associations],
+            [
+                ('decause', 'member'),
+                ('dhrish', u'member'),
+                ('ralph', u'owner'),
+                ('shalini', 'subscriber'),
+            ]
+        )
+
     def test_suggest_users_no_filter(self):
         user = FakeAuthorization('ralph')
         expected = [
diff --git a/hubs/views/api/hub_config.py b/hubs/views/api/hub_config.py
index fa76e29..284c837 100644
--- a/hubs/views/api/hub_config.py
+++ b/hubs/views/api/hub_config.py
@@ -82,8 +82,11 @@ def hub_config_put_users(hub, user_roles):
         for u in user_roles[role]:
             new_associations.append((u["username"], role))
     # Remove old associations
-    for assoc in hub.associations:
-        if assoc.hub != hub:
+    # Note: don't iter and edit hubs.associations in the same loop, it's an
+    # instrumented list by SQLAlchemy.
+    for assoc in list(hub.associations):
+        if assoc.role not in ("owner", "member"):
+            # Leave alone the subscribers and stargazers.
             continue
         try:
             new_associations.remove(