influxdata / influxdata/influxdb

Users - api - able to create a user without the required name field

Open
#23,788 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
31.7k
Forks
3.7k
Avg merge
13h 37m
Merged PRs (30d)
8

Description

__Steps to reproduce:__
List the minimal actions needed to reproduce the behavior.

Testing directly against the API

1. Prepare a User requestBody, but leave out the name field.
2. POST the request to the endpoint `api/v2/users`

The request data

```json
{
"oauthID": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIwMTIzNDU2Nzg5QUJDREVGIiwibmFtZSI6Ikh5ZW5hMDA3IiwiaWF0IjoxMDAwMDAwMDAxfQ.Gb4EnTVSUg55eYlXTvXJYs8oQ37rgefHh3FChGEJ80U",
"status":"active",
"role":"owner",
"org_id":
"2d379394d1f6b2fd"
}
```

__Expected behavior:__
Expected that since the required field `name` is missing, that the request would be rejected and the return HTTP status would be 400.

from openapi `src/common/schemas/User.yml`

```yaml
properties:
id:
readOnly: true
type: string
description: The user ID.
oauthID:
type: string
description: The OAuth ID.
name:
type: string
description: The user name.
status:
description: |
If `inactive`, the user is inactive.
Default is `active`.
default: active
type: string
enum:
- active
- inactive
required: [name]
~
```

__Actual behavior:__
The server returns 201 and a new user artifact with an empty name field.

The response body

```json
{
"links": {
"self": "/api/v2/users/0a20185faf358000"
},
"id": "0a20185faf358000",
"name": "",
"oauthID": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIwMTIzNDU2Nzg5QUJDREVGIiwibmFtZSI6Ikh5ZW5hMDA3IiwiaWF0IjoxMDAwMDAwMDAxfQ.Gb4EnTVSUg55eYlXTvXJYs8oQ37rgefHh3FChGEJ80U",
"status": "active"
}
```

__Environment info:__

Testing against K8SIDPE remocal.

Latest commit

```
commit 0f8ac3d3ca10c0bce971461a51d3654f5dd66f0d (HEAD -> master, origin/master, origin/HEAD)
Author: Wojciech Kocjan
Date: Thu Oct 13 07:51:24 2022 +0200
```

Contributor guide

Open the contributing guide

Research direction

Start with src/common/schemas/User.yml and the POST /api/v2/users request path, then reproduce the request with name omitted. Done means the API rejects the request with HTTP 400 and does not create a user with an empty name.

Written by the indexing model from the issue text.

Assessment

Tech stack
openapi
Domain
api, backend
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.