goharbor / goharbor/harbor-cli

[bug]: Fix user lookup bug causing operations on UserID 0 and ignoring pagination

Open
#819 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Go
Stars
163
Forks
211
Avg merge
1m
Merged PRs (30d)
1

Description

## Description
There is a critical issue in the `harbor user delete`, `elevate`, and `password` commands where user lookup by name is unreliable and may result in unintended operations on `UserID 0`.

The CLI claims to support "name or id", but:
- User lookup only checks the first page of results (pagination is ignored)
- If a user is not found, the function returns `(0, nil)` instead of an error
- This causes destructive operations (e.g., delete) to execute on `UserID 0`
- Numeric inputs are not treated as IDs, but as usernames

This leads to incorrect behavior and potential safety risks.

## Steps to Reproduce
Case 1: Non-existent username
1. Run command:
harbor user delete some_nonexistent_user
2. Observe behavior

Case 2: User exists but not on first page
1. Ensure the target user is not present on page 1 of ListUsers
2. Run command:
harbor user delete
3. Observe behavior

Case 3: Using numeric ID
1. Run command:
harbor user delete 123
2. Observe behavior

## Expected Behavior
- The CLI should search across all pages or use server-side filtering
- It should return an error if the user is not found
- Numeric input should be interpreted as a user ID
- No operation should be executed when the user cannot be resolved

## Actual Behavior
- Only the first page of users is searched
- If the user is not found, the function returns UserID 0 with no error
- Commands proceed with destructive API calls using UserID 0
- Numeric inputs are treated as usernames instead of IDs

## Environment
- OS: (e.g., Ubuntu 22.04 / Windows 11)
- Tool version: (e.g., harbor CLI vX.X.X)
- Other relevant details: N/A

## Additional Context
Root cause:
- api.GetUsersIdByName does not handle pagination
- It returns (0, nil) when no match is found
- CLI commands do not validate the returned ID before making API calls
- No parsing is done to distinguish numeric IDs from usernames

Suggested fixes:
- Implement pagination in user lookup
- Return explicit error when user is not found
- Parse numeric arguments as IDs before falling back to name lookup

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.