API: setting upgrade quotas via query should ignore missing account IDs of other users

[haraldschilly]

given you have a project with upgrades from user A and B, i.e. there is this {"upgrades": ...} dict for both users. You're under control of user A via your API key.

You send an API query to apply quotas to the project for user A, e.g.

{"query": {"projects": {"project_id": "...", "users": {"<user A>": {"upgrades": {"disk_quota". .... }}}}}}

which does not include {"<user B>": ....}.

Right now, the check _user_set_query_project_change_before tests for all keys of the old and new values. This means, underscore.isEqual(old_val?[id]?.upgrades, new_val?[id]?.upgrades) will be triggered because there is no data about user B in the query.

A sane alternative would be to merge the old value with the new value as an update for user A (and only user A!) and hence keep all the values for the other users as they are. That way, the partial update will succeed.

[williamstein]

I am nervous about changing how the query endpoint works. The query endpoint is pretty low level, debugged, used heavily to implement a lot of things, and changing it might lead to subtle bugs and added code complexity. Instead, since people are setting quotas via the API and finding the query endpoint confusing, we could add another endpoint that is specifically for setting quotas via the API.