influxdata / influxdata/influxdb

Read/Write API token cannot create bucket, but can delete bucket

Open
#23,170 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
31.7k
Forks
3.7k
Avg merge
13h 37m
Merged PRs (30d)
8

Description

__Steps to reproduce:__
1. create a read/write token under 'my-org'
2. create a bucket called 'my-bucket' under 'my-org'
3. use the following code to delete the 'my-bucket'

```
bucket = client.buckets_api().find_buckets(org='my-org', name='my-bucket')
bucket = bucket.buckets[0]
client.buckets_api().delete_bucket(bucket)
```

__Expected behavior:__
The Read/Write API token should not have access to delete the bucket
Note: The Read/Write API token cannot create the bucket, which is expected

__Actual behavior:__
The 'my-bucket' has been deleted by a read/write api

__Specifications:__
- Client Version: 1.26.0
- InfluxDB Version: 2.1.1
- Platform: macos

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the bucket deletion with the stated Read/Write token, client version 1.26.0, and InfluxDB 2.1.1, then trace the bucket API's authorization decision. Done means a Read/Write token cannot delete a bucket, while its permitted operations continue to work.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
authorization, databases
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.