influxdata / influxdata/influxdb
Deleting a user interacting with tokens
- Dominant language
- Rust
- Stars
- 31.7k
- Forks
- 3.7k
- Avg merge
- 13h 37m
- Merged PRs (30d)
- 8
Description
__Steps to reproduce:__
List the minimal actions needed to reproduce the behavior.
1. Create a new influxdb user
2. Create a token for that user
3. Delete the user
4. List tokens
5. Use the token from the deleted user
__Expected behavior:__
Not sure. Either the token should still be valid, or the token should be completely deleted
__Actual behavior:__
In OSS at least, the token is not deleted. But, when we try to list tokens or use the token, we get errors in the logs because the token refers to a user that does not exist.
The token for the deleted user is not listed, and the logs show:
```
Failed to get user {"log_id": "0XJWMq_0000", "userID": "085380936b573000", "error": "user not found"}
Failed to create auth response {"log_id": "0XJWMq_0000", "handler": "getAuthorizations"}
```
Trying to use the token gives:
```
Error: could not find authorization with given parameters: 403 Forbidden: User is inactive
```
`influxd recovery auth list` shows that the token is still present in the database though.
__Environment info:__
* System info: Darwin 20.6.0 x86_64
* InfluxDB version: InfluxDB dev (git: 05e6dc65c5) build_date: 2021-10-20T14:15:20Z
Contributor guide
Research direction
Reproduce the sequence of creating a user and token, deleting the user, listing tokens, and using the token; also inspect the output of `influxd recovery auth list`. Trace the user-deletion and token authorization paths, then establish the intended behavior and cover the resulting handling of tokens whose user no longer exists.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- authentication, databases
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100