goharbor / goharbor/harbor-cli
[bug]: Fix user lookup bug causing operations on UserID 0 and ignoring pagination
- Dominant language
- Go
- Stars
- 163
- Forks
- 211
- Avg merge
- 1m
- Merged PRs (30d)
- 1
Description
## Description
There is a critical issue in the `harbor user delete`, `elevate`, and `password` commands where user lookup by name is unreliable and may result in unintended operations on `UserID 0`.
The CLI claims to support "name or id", but:
- User lookup only checks the first page of results (pagination is ignored)
- If a user is not found, the function returns `(0, nil)` instead of an error
- This causes destructive operations (e.g., delete) to execute on `UserID 0`
- Numeric inputs are not treated as IDs, but as usernames
This leads to incorrect behavior and potential safety risks.
## Steps to Reproduce
Case 1: Non-existent username
1. Run command:
harbor user delete some_nonexistent_user
2. Observe behavior
Case 2: User exists but not on first page
1. Ensure the target user is not present on page 1 of ListUsers
2. Run command:
harbor user delete
3. Observe behavior
Case 3: Using numeric ID
1. Run command:
harbor user delete 123
2. Observe behavior
## Expected Behavior
- The CLI should search across all pages or use server-side filtering
- It should return an error if the user is not found
- Numeric input should be interpreted as a user ID
- No operation should be executed when the user cannot be resolved
## Actual Behavior
- Only the first page of users is searched
- If the user is not found, the function returns UserID 0 with no error
- Commands proceed with destructive API calls using UserID 0
- Numeric inputs are treated as usernames instead of IDs
## Environment
- OS: (e.g., Ubuntu 22.04 / Windows 11)
- Tool version: (e.g., harbor CLI vX.X.X)
- Other relevant details: N/A
## Additional Context
Root cause:
- api.GetUsersIdByName does not handle pagination
- It returns (0, nil) when no match is found
- CLI commands do not validate the returned ID before making API calls
- No parsing is done to distinguish numeric IDs from usernames
Suggested fixes:
- Implement pagination in user lookup
- Return explicit error when user is not found
- Parse numeric arguments as IDs before falling back to name lookup
Contributor guide
Assessment
This issue has not been assessed yet.