add group owner to LDAP schema, change objectClass

CHANGELOG.md

@@ -4,6 +4,15 @@ For details on the changes in each release, see [the Releases page](https://gith
 
 ## Version-specific update instructions:
 
+### 1.8 -> 1.9
+- schema migration:
+  - add the new LDAP schema in conjunction with the old
+  - shut down the account portal
+  - add the `xGroup` objectClass to all PI groups
+  - remove the `piGroup` object class from all PI groups
+  - run the `setup-pi-group-owners.php` worker
+  - restart the account portal
+
 ### 1.7 -> 1.8
 - the [webhook] section of the config file can be removed
 - all mail templates are no longer PHP files, now they are `.html.twig`

resources/lib/UnityGroup.php

@@ -352,9 +352,10 @@ private function init(): void
         assert(!$this->entry->exists());
         $nextGID = $this->LDAP->getNextPIGIDNumber();
         $this->entry->create([
-            "objectclass" => ["piGroup", "posixGroup", "top"],
+            "objectclass" => ["xGroup", "posixGroup", "top"],
             "gidnumber" => strval($nextGID),
             "memberuid" => [$owner->uid],
+            "owneruid" => $owner->uid,
         ]);
         // TODO if we ever make this project based,
         // we need to update the cache here with the memberuid
@@ -480,7 +481,7 @@ public function addPlusAddressToMail(string $mail): string
         $owner = $this->getOwner();
         $suffix = "_" . $owner->getOrg();
         assert(str_ends_with($owner->uid, $suffix));
-        $short_name = substr($owner->uid, 0, -1 * strlen($suffix));
+        $short_name = substr($owner->uid, 0, -strlen($suffix));
         $parts = explode("@", $mail, 2);
         return sprintf("%s+%s@%s", $parts[0], $short_name, $parts[1]);
     }

tools/docker-dev/identity/account-portal-schema.ldif

@@ -12,7 +12,17 @@ olcAttributeTypes: ( 1.1.3 NAME 'managerUid'
     EQUALITY caseExactIA5Match
     SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
     )
+olcAttributeTypes: ( 1.1.4 NAME 'ownerUid'
+    DESC 'group owner'
+    EQUALITY caseExactIA5Match
+    SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
+    SINGLE-VALUE
+    )
 olcObjectClasses: ( 1.1.2 NAME 'piGroup' SUP top AUXILIARY
-    DESC 'PI Group'
+    DESC 'DEPRECATED, DO NOT USE'
     MAY ( isDisabled $ managerUid )
     )
+olcObjectClasses: ( 1.1.5 NAME 'xGroup' SUP top AUXILIARY
+    DESC 'extended group'
+    MAY ( isDisabled $ managerUid $ ownerUid )
+    )