influxdata / influxdata/influxdb
Read/Write API token cannot create bucket, but can delete bucket
- Dominant language
- Rust
- Stars
- 31.7k
- Forks
- 3.7k
- Avg merge
- 13h 37m
- Merged PRs (30d)
- 8
Description
__Steps to reproduce:__
1. create a read/write token under 'my-org'
2. create a bucket called 'my-bucket' under 'my-org'
3. use the following code to delete the 'my-bucket'
```
bucket = client.buckets_api().find_buckets(org='my-org', name='my-bucket')
bucket = bucket.buckets[0]
client.buckets_api().delete_bucket(bucket)
```
__Expected behavior:__
The Read/Write API token should not have access to delete the bucket
Note: The Read/Write API token cannot create the bucket, which is expected
__Actual behavior:__
The 'my-bucket' has been deleted by a read/write api
__Specifications:__
- Client Version: 1.26.0
- InfluxDB Version: 2.1.1
- Platform: macos
Contributor guide
Research direction
Start by reproducing the bucket deletion with the stated Read/Write token, client version 1.26.0, and InfluxDB 2.1.1, then trace the bucket API's authorization decision. Done means a Read/Write token cannot delete a bucket, while its permitted operations continue to work.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- authorization, databases
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100