influxdata / influxdata/influxdb
`influx auth create` does not work as expected for system buckets
- Dominant language
- Rust
- Stars
- 31.7k
- Forks
- 3.7k
- Avg merge
- 13h 37m
- Merged PRs (30d)
- 8
Description
The issue here is that if you use `influx auth create` with read/write access to a system bucket like `_monitoring`, the token appears to be created successfully, however these system buckets are not actually accessible to anything other than an all-access token (apparently).
For example:
```
./influx bucket list
ID Name Retention Shard group duration Organization ID
1c9450961b31a442 _monitoring 168h0m0s 24h0m0s f50eed62e5df577e
3d216bc6005d3847 _tasks 72h0m0s 24h0m0s f50eed62e5df577e
6e480b4d6faf6d3b bucket infinite 168h0m0s f50eed62e5df577e
```
```
./influx auth create --read-bucket 1c9450961b31a442 --write-bucket 1c9450961b31a442
```
Then if you make a config using that token and set it to active...
```
./influx bucket list
ID Name Retention Shard group duration Organization ID
```
Ideally, the created token would either have access to the bucket, or an error would be returned to indicate that such a token is not possible.
Contributor guide
Research direction
Reproduce the issue with `influx auth create` and `influx bucket list` using `_monitoring` or `_tasks`. Trace the auth-create entry point and the authorization path for system buckets; done means the token can access the bucket or creation returns a clear error explaining that it cannot.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- authorization, cli, databases
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100