fix: add createdBy to readACL as well

[omkar-ethz]

Bug: When editing a paragraph with a file, the newly created file snippet contained an empty readACL, as it neither had a parent snippet, nor accessGroups were passed by the UI. updateACL was correctly set to createdBy (based on user's token). As a result, getById repository calls for the new file snippet with {user} context would fail, as the user wasn't in the readACL.

Fix this by also adding createdBy to readACL.

[minottic]

I am ultimately fine with this, but shouldn't the fix pass the ACLs to the file from the UI, rather than adding the email here?

[omkar-ethz]

I am ultimately fine with this, but shouldn't the fix pass the ACLs to the file from the UI, rather than adding the email here?

the rationale for making the backend change was that creator should have read access - so this fix seemed reasonable regardless of the bug.

i'm not sure about trusting ACL/accessGroup info passed via the UI - right now, an unprivileged user can pass any accessGroups and the backend accepts it.. so the overall feature seems a little broken as it is.

But you are right, as a logbook can have multiple accessGroups, all those should be included for the edited file too. i will fix this on the UI as well in the next commit on monday. thanks!

[minottic]

thanks. I agree ACLs are a bit brokne...

[minottic]

minor comment

[minottic]

how did this not fail before?