oxidecomputer / oxidecomputer/omicron
`/v1/system/update/repository/{system_version}` returns 403 instead of 404
Open
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 572
- Forks
- 97
- Avg merge
- 2d 12h
- Merged PRs (30d)
- 96
Description
This likely should be Visibility::Protected, which requires fixing the implementation to correctly return 404 instead of 403 if the repository exists but the caller doesn't have access to view it.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the integration test at nexus/tests/integration_tests/endpoints.rs:2489-2496 and trace the /v1/system/update/repository/{system_version} endpoint implementation. Verify the visibility and access-control behavior for an existing repository the caller cannot view. Done means the endpoint returns 404 rather than 403 in that case, with the relevant test passing.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- api, authorization
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100