influxdata / influxdata/influxdb
Users - api - able to create a user without the required name field
- Dominant language
- Rust
- Stars
- 31.7k
- Forks
- 3.7k
- Avg merge
- 13h 37m
- Merged PRs (30d)
- 8
Description
__Steps to reproduce:__
List the minimal actions needed to reproduce the behavior.
Testing directly against the API
1. Prepare a User requestBody, but leave out the name field.
2. POST the request to the endpoint `api/v2/users`
The request data
```json
{
"oauthID": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIwMTIzNDU2Nzg5QUJDREVGIiwibmFtZSI6Ikh5ZW5hMDA3IiwiaWF0IjoxMDAwMDAwMDAxfQ.Gb4EnTVSUg55eYlXTvXJYs8oQ37rgefHh3FChGEJ80U",
"status":"active",
"role":"owner",
"org_id":
"2d379394d1f6b2fd"
}
```
__Expected behavior:__
Expected that since the required field `name` is missing, that the request would be rejected and the return HTTP status would be 400.
from openapi `src/common/schemas/User.yml`
```yaml
properties:
id:
readOnly: true
type: string
description: The user ID.
oauthID:
type: string
description: The OAuth ID.
name:
type: string
description: The user name.
status:
description: |
If `inactive`, the user is inactive.
Default is `active`.
default: active
type: string
enum:
- active
- inactive
required: [name]
~
```
__Actual behavior:__
The server returns 201 and a new user artifact with an empty name field.
The response body
```json
{
"links": {
"self": "/api/v2/users/0a20185faf358000"
},
"id": "0a20185faf358000",
"name": "",
"oauthID": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIwMTIzNDU2Nzg5QUJDREVGIiwibmFtZSI6Ikh5ZW5hMDA3IiwiaWF0IjoxMDAwMDAwMDAxfQ.Gb4EnTVSUg55eYlXTvXJYs8oQ37rgefHh3FChGEJ80U",
"status": "active"
}
```
__Environment info:__
Testing against K8SIDPE remocal.
Latest commit
```
commit 0f8ac3d3ca10c0bce971461a51d3654f5dd66f0d (HEAD -> master, origin/master, origin/HEAD)
Author: Wojciech Kocjan
Date: Thu Oct 13 07:51:24 2022 +0200
```
Contributor guide
Research direction
Start with src/common/schemas/User.yml and the POST /api/v2/users request path, then reproduce the request with name omitted. Done means the API rejects the request with HTTP 400 and does not create a user with an empty name.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- openapi
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100