We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
Return 400 if a group contains system.Everyone or a group URL
Unless I'm mistaken:
- We don't support groups for anonymous requests
- We don't support recursivity in groups definitions

So we should reject with `400` if such groups definitons are created


--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `kinto/views/groups.py`
Content:
```
1 import colander
2 
3 from kinto.core import resource, utils
4 from kinto.core.events import ResourceChanged, ACTIONS
5 from pyramid.events import subscriber
6 
7 
8 class GroupSchema(resource.ResourceSchema):
9     members = colander.SchemaNode(colander.Sequence(),
10                                   colander.SchemaNode(colander.String()))
11 
12 
13 @resource.register(name='group',
14                    collection_path='/buckets/{{bucket_id}}/groups',
15                    record_path='/buckets/{{bucket_id}}/groups/{{id}}')
16 class Group(resource.ShareableResource):
17     mapping = GroupSchema()
18 
19     def get_parent_id(self, request):
20         bucket_id = request.matchdict['bucket_id']
21         parent_id = utils.instance_uri(request, 'bucket', id=bucket_id)
22         return parent_id
23 
24 
25 @subscriber(ResourceChanged,
26             for_resources=('group',),
27             for_actions=(ACTIONS.DELETE,))
28 def on_groups_deleted(event):
29     """Some groups were deleted, remove them from users principals.
30     """
31     permission_backend = event.request.registry.permission
32 
33     for change in event.impacted_records:
34         group = change['old']
35         bucket_id = event.payload['bucket_id']
36         group_uri = utils.instance_uri(event.request, 'group',
37                                        bucket_id=bucket_id,
38                                        id=group['id'])
39 
40         permission_backend.remove_principal(group_uri)
41 
42 
43 @subscriber(ResourceChanged,
44             for_resources=('group',),
45             for_actions=(ACTIONS.CREATE, ACTIONS.UPDATE))
46 def on_groups_changed(event):
47     """Some groups were changed, update users principals.
48     """
49     permission_backend = event.request.registry.permission
50 
51     for change in event.impacted_records:
52         if 'old' in change:
53             existing_record_members = set(change['old'].get('members', []))
54         else:
55             existing_record_members = set()
56 
57         group = change['new']
58         group_uri = '/buckets/{bucket_id}/groups/{id}'.format(id=group['id'],
59                                                               **event.payload)
60         new_record_members = set(group.get('members', []))
61         new_members = new_record_members - existing_record_members
62         removed_members = existing_record_members - new_record_members
63 
64         for member in new_members:
65             # Add the group to the member principal.
66             permission_backend.add_user_principal(member, group_uri)
67 
68         for member in removed_members:
69             # Remove the group from the member principal.
70             permission_backend.remove_user_principal(member, group_uri)
71
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/kinto/views/groups.py b/kinto/views/groups.py
--- a/kinto/views/groups.py
+++ b/kinto/views/groups.py
@@ -5,9 +5,15 @@
 from pyramid.events import subscriber
 
 
+def validate_member(node, member):
+    if member.startswith('/buckets/') or member == 'system.Everyone':
+        raise colander.Invalid(node, "%r is not a valid user ID." % member)
+
+
 class GroupSchema(resource.ResourceSchema):
     members = colander.SchemaNode(colander.Sequence(),
-                                  colander.SchemaNode(colander.String()))
+                                  colander.SchemaNode(colander.String(),
+                                                      validator=validate_member))
 
 
 @resource.register(name='group',

{"golden_diff": "diff --git a/kinto/views/groups.py b/kinto/views/groups.py\n--- a/kinto/views/groups.py\n+++ b/kinto/views/groups.py\n@@ -5,9 +5,15 @@\n from pyramid.events import subscriber\n \n \n+def validate_member(node, member):\n+    if member.startswith('/buckets/') or member == 'system.Everyone':\n+        raise colander.Invalid(node, \"%r is not a valid user ID.\" % member)\n+\n+\n class GroupSchema(resource.ResourceSchema):\n     members = colander.SchemaNode(colander.Sequence(),\n-                                  colander.SchemaNode(colander.String()))\n+                                  colander.SchemaNode(colander.String(),\n+                                                      validator=validate_member))\n \n \n @resource.register(name='group',\n", "issue": "Return 400 if a group contains system.Everyone or a group URL\nUnless I'm mistaken:\n- We don't support groups for anonymous requests\n- We don't support recursivity in groups definitions\n\nSo we should reject with `400` if such groups definitons are created\n\n", "before_files": [{"content": "import colander\n\nfrom kinto.core import resource, utils\nfrom kinto.core.events import ResourceChanged, ACTIONS\nfrom pyramid.events import subscriber\n\n\nclass GroupSchema(resource.ResourceSchema):\n    members = colander.SchemaNode(colander.Sequence(),\n                                  colander.SchemaNode(colander.String()))\n\n\n@resource.register(name='group',\n                   collection_path='/buckets/{{bucket_id}}/groups',\n                   record_path='/buckets/{{bucket_id}}/groups/{{id}}')\nclass Group(resource.ShareableResource):\n    mapping = GroupSchema()\n\n    def get_parent_id(self, request):\n        bucket_id = request.matchdict['bucket_id']\n        parent_id = utils.instance_uri(request, 'bucket', id=bucket_id)\n        return parent_id\n\n\n@subscriber(ResourceChanged,\n            for_resources=('group',),\n            for_actions=(ACTIONS.DELETE,))\ndef on_groups_deleted(event):\n    \"\"\"Some groups were deleted, remove them from users principals.\n    \"\"\"\n    permission_backend = event.request.registry.permission\n\n    for change in event.impacted_records:\n        group = change['old']\n        bucket_id = event.payload['bucket_id']\n        group_uri = utils.instance_uri(event.request, 'group',\n                                       bucket_id=bucket_id,\n                                       id=group['id'])\n\n        permission_backend.remove_principal(group_uri)\n\n\n@subscriber(ResourceChanged,\n            for_resources=('group',),\n            for_actions=(ACTIONS.CREATE, ACTIONS.UPDATE))\ndef on_groups_changed(event):\n    \"\"\"Some groups were changed, update users principals.\n    \"\"\"\n    permission_backend = event.request.registry.permission\n\n    for change in event.impacted_records:\n        if 'old' in change:\n            existing_record_members = set(change['old'].get('members', []))\n        else:\n            existing_record_members = set()\n\n        group = change['new']\n        group_uri = '/buckets/{bucket_id}/groups/{id}'.format(id=group['id'],\n                                                              **event.payload)\n        new_record_members = set(group.get('members', []))\n        new_members = new_record_members - existing_record_members\n        removed_members = existing_record_members - new_record_members\n\n        for member in new_members:\n            # Add the group to the member principal.\n            permission_backend.add_user_principal(member, group_uri)\n\n        for member in removed_members:\n            # Remove the group from the member principal.\n            permission_backend.remove_user_principal(member, group_uri)\n", "path": "kinto/views/groups.py"}], "after_files": [{"content": "import colander\n\nfrom kinto.core import resource, utils\nfrom kinto.core.events import ResourceChanged, ACTIONS\nfrom pyramid.events import subscriber\n\n\ndef validate_member(node, member):\n    if member.startswith('/buckets/') or member == 'system.Everyone':\n        raise colander.Invalid(node, \"%r is not a valid user ID.\" % member)\n\n\nclass GroupSchema(resource.ResourceSchema):\n    members = colander.SchemaNode(colander.Sequence(),\n                                  colander.SchemaNode(colander.String(),\n                                                      validator=validate_member))\n\n\n@resource.register(name='group',\n                   collection_path='/buckets/{{bucket_id}}/groups',\n                   record_path='/buckets/{{bucket_id}}/groups/{{id}}')\nclass Group(resource.ShareableResource):\n    mapping = GroupSchema()\n\n    def get_parent_id(self, request):\n        bucket_id = request.matchdict['bucket_id']\n        parent_id = utils.instance_uri(request, 'bucket', id=bucket_id)\n        return parent_id\n\n\n@subscriber(ResourceChanged,\n            for_resources=('group',),\n            for_actions=(ACTIONS.DELETE,))\ndef on_groups_deleted(event):\n    \"\"\"Some groups were deleted, remove them from users principals.\n    \"\"\"\n    permission_backend = event.request.registry.permission\n\n    for change in event.impacted_records:\n        group = change['old']\n        bucket_id = event.payload['bucket_id']\n        group_uri = utils.instance_uri(event.request, 'group',\n                                       bucket_id=bucket_id,\n                                       id=group['id'])\n\n        permission_backend.remove_principal(group_uri)\n\n\n@subscriber(ResourceChanged,\n            for_resources=('group',),\n            for_actions=(ACTIONS.CREATE, ACTIONS.UPDATE))\ndef on_groups_changed(event):\n    \"\"\"Some groups were changed, update users principals.\n    \"\"\"\n    permission_backend = event.request.registry.permission\n\n    for change in event.impacted_records:\n        if 'old' in change:\n            existing_record_members = set(change['old'].get('members', []))\n        else:\n            existing_record_members = set()\n\n        group = change['new']\n        group_uri = '/buckets/{bucket_id}/groups/{id}'.format(id=group['id'],\n                                                              **event.payload)\n        new_record_members = set(group.get('members', []))\n        new_members = new_record_members - existing_record_members\n        removed_members = existing_record_members - new_record_members\n\n        for member in new_members:\n            # Add the group to the member principal.\n            permission_backend.add_user_principal(member, group_uri)\n\n        for member in removed_members:\n            # Remove the group from the member principal.\n            permission_backend.remove_user_principal(member, group_uri)\n", "path": "kinto/views/groups.py"}]}