acl: a deleted ACL policy still shows when reading token it was assigned to
- Dominant language
- Go
- Stars
- 17k
- Forks
- 2.1k
- Avg merge
- 1d 9h
- Merged PRs (30d)
- 105
Description
### Nomad version
`Nomad v1.3.3 (428b2cd8014c48ee9eae23f02712b7219da16d30)`
### Operating system and Environment details
Tested locally on macOS using a development agent.
### Issue
When an ACL policy is deleted that is referenced by an active ACL token, the ACL token CLI and API still details the linked policy.
### Reproduction steps
1. Run a development agent using the following config snippet to ensure ACLs are enabled:
```
acl {
enabled = true
}
```
2. Bootstrap the ACL system via the `nomad acl boostrap` command.
3. Create an ACL policy using the example policy below via the `nomad acl policy apply -token= test `:
```
node {
policy = "read"
}
```
4. Create an ACL token referencing the policy created above via `nomad acl token create -policy=test`
5. Delete the policy via `nomad acl policy delete test`
6. Read the information regarding the created token using `nomad acl token -token= self`
#### Expected Result
The final read of the token shows no policies linked.
#### Actual Result
The delete policy still shows, which can be a little confusing when trying to understand why the token no longer works.
Contributor guide
No contributing guide indexed for this repository
Research direction
Reproduce the behavior with the documented ACL policy and token commands, then trace the ACL token self/read path used by the CLI and API. The fix is complete when a token referencing a deleted policy shows no linked policies, while the existing reproduction still works for active policies.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- api, authorization, cli
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100