From 9bdf7066debc821fbffc731509fe178202724aad Mon Sep 17 00:00:00 2001
From: Aurélien Bompard <aurelien@bompard.org>
Date: Nov 16 2017 16:49:34 +0000
Subject: Fix setting of a hub's members


---

diff --git a/hubs/tests/views/test_api_hub_config.py b/hubs/tests/views/test_api_hub_config.py
index 16a766e..09b030e 100644
--- a/hubs/tests/views/test_api_hub_config.py
+++ b/hubs/tests/views/test_api_hub_config.py
@@ -182,6 +182,32 @@ class TestAPIHubConfig(APPTest):
             ]
         )
 
+    def test_put_users_other_roles(self):
+        # Only deal with the "member" and "owner" roles.
+        hub = Hub.by_name('ralph')
+        user = FakeAuthorization('ralph')
+        with auth_set(app, user):
+            result = self.app.put(
+                '/api/hubs/ralph/config',
+                content_type="application/json",
+                data=json.dumps({
+                    "users": {
+                        "owner": [{"username": "ralph"}],
+                        "subscriber": [
+                            {"username": "decause"},
+                            {"username": "ralph"},
+                        ],
+                    }
+                })
+            )
+        self.assertEqual(result.status_code, 200)
+        result_data = json.loads(result.get_data(as_text=True))
+        self.assertEqual(result_data["status"], "OK")
+        self.assertListEqual(
+            [(a.user_id, a.role) for a in hub.associations],
+            [('ralph', u'owner')]
+        )
+
     def test_suggest_users_no_filter(self):
         user = FakeAuthorization('ralph')
         expected = [
diff --git a/hubs/views/api/hub_config.py b/hubs/views/api/hub_config.py
index 7da572c..f4cc9ed 100644
--- a/hubs/views/api/hub_config.py
+++ b/hubs/views/api/hub_config.py
@@ -77,16 +77,18 @@ def hub_config_put_config(hub, config):
 
 
 def hub_config_put_users(hub, user_roles):
+    ONLY_ROLES = ("owner", "member")  # Leave alone subscribers and stargazers.
     new_associations = []
     for role in user_roles:
+        if role not in ONLY_ROLES:
+            continue
         for u in user_roles[role]:
             new_associations.append((u["username"], role))
     # Remove old associations
     # Note: don't iter and edit hubs.associations in the same loop, it's an
     # instrumented list by SQLAlchemy.
     for assoc in list(hub.associations):
-        if assoc.role not in ("owner", "member"):
-            # Leave alone the subscribers and stargazers.
+        if assoc.role not in ONLY_ROLES:
             continue
         try:
             new_associations.remove(