Why cannot a user with read only access fetch user list for a repository but it can clone the repo

[Aalok Sood]

A user with read only access can clone the repository, and hence can read all commits and get information about the authors.

The 2.0 rest apis are sending the entire commit history and that includes the author information.

The logged in user with read only access can fetch the user information for any user with key of that user.

It's super weird that a user with read only access can fetch every possible data but not the list of members? Is there some logic behind this?

How can a user with read only access fetch the list of members for a repository via 2.0 REST api? 

Is this behaviour documented somewhere? I have been reading the API docs for a few days now but unable to find anything on this.

[Mark C]

Hi @Aalok Sood

Welcome to the community.

We do have the below API 2.0 endpoint that you can use to get repository users/members permissions.

/2.0/workspaces/{workspace}/permissions/repositories/{repo_slug}

However, according to the API 2.0 endpoint documentation:

Only users with admin permission for the repository may access this resource.

If you're using the above API 2.0 endpoint, I'm afraid that endpoint can only be accessed by users with Admin access.
Hence, users with read-only access cannot access that endpoint and get user/members' repository permission.

This is also true in a repository on the Bitbucket.org UI.
Users with read-only access can view the Commits page but the user will not be able to access the Repository settings to view all members/users added to that repository.

Do let me know if you have further questions about it.

Regards,
Mark C