-
Notifications
You must be signed in to change notification settings - Fork 6.4k
fix: return a codes.NotFound
error when trying to get a non-existent repository
#7548
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix: return a codes.NotFound
error when trying to get a non-existent repository
#7548
Conversation
6ef5e6c
to
fdb4e32
Compare
…repository Signed-off-by: Simon Ninon <simon.ninon@gmail.com>
fdb4e32
to
45e2985
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for this PR @Cylix and also for the detailed description into your train of thoughts. That is much appreciated!
I have a change request, please see below.
server/repository/repository.go
Outdated
exists, err := s.db.RepositoryExists(ctx, q.Repo) | ||
if !exists { | ||
return nil, status.Errorf(codes.NotFound, "repo '%s' not found", q.Repo) | ||
} | ||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This needs to be moved to after the permission check (EnforceErr
) below, otherwise, configuration guessing would be possible by an unauthorized party. The behavior must be to return a permission denied if the user does not have access to a certain repository, regardless of whether the repository is actually configured or not.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for the review @jannfis!
That's a good catch, I haven't thought about that! I moved the logic after the permission check as suggested, and I retested
Feel free to let me know if you'd like me to adjust anything else 👀
Signed-off-by: Simon Ninon <simon.ninon@gmail.com>
6382514
to
9eb1059
Compare
Signed-off-by: Simon Ninon <simon.ninon@gmail.com>
3fd97ca
to
483f733
Compare
Hey @jannfis: just to let you know that I also updated the unit tests to add proper coverage/ Took me a bit to get my local environment properly configured to run the unit tests, but it seems to be passing locally. Do you know what's the way to trigger the pending workflows? Thanks! |
The pending CI workflows need to be triggered manually by someone with write permissions by the repo. This is a GitHub actions security feature and applied for first-time contributors to a given repository. I have triggered the workflow. |
Codecov Report
@@ Coverage Diff @@
## master #7548 +/- ##
==========================================
+ Coverage 41.35% 41.39% +0.03%
==========================================
Files 161 161
Lines 21606 21633 +27
==========================================
+ Hits 8936 8955 +19
- Misses 11407 11415 +8
Partials 1263 1263
Continue to review full report at Codecov.
|
Got it, thanks for the explanation and for triggering the pipeline! It seems the CI passed this time around 🎉 Let me know if there is anything I should adjust (code logic, unit tests, whatever...) 🙃 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM, thank you @Cylix !
Context
Addressing #5951. More details can be found in the issue discussion, but as a quick summary:
argo repo get <repo>
and/api/v1/repositories/{repo}
are documented asGet a **configured** repository by URL
.Get() Repository
does not return an error when querying a repo that is not configured in Argo.In particular,
Get() Repository
relies on this db.getRepository. However, this function returns a valid repository object when no configured repository is found, rather than nil with an error. This contrasts withdb.DeleteRepository
that does return an error for unconfigured repositoriesChange
db.GetRepository
is called in different places, so I decided to avoid touching it, and instead implement a newdb.RepositoryExists
function that returns whether a repository matching the query is configured in Argo.I then called this function from
Get() Repository
and propagated acodes.NotFound
error as appropriate.Alternatives
I thought about a couple of alternative implementations, let me know if an approach is preferred:
db.GetRepository
to return an error when a repository is not found, rather than an empty repository object. This would need to be done carefully to avoid breaking things for logic that relies on that current behavior ofdb.GetRepository
. A few approaches I can think about:default
parameter todb.GetRepository
that would be the default return value if no repository is founddb.GetRepository
to every call site whenrepo == nil && err == nil
Get a **configured** repository by URL
).Testing
Manual Testing
Configured Repo (API):
Configured Repo (CLI):
Unconfigured Repo (API):
Unconfigured Repo (CLI):
$ argocd --server localhost:8080 --plaintext --grpc-web repo get https://github.com/foo/example-project.git FATA[0000] rpc error: code = NotFound desc = repo 'https://github.com/foo/example-project.git' not found
Unit Tests
Added unit tests coverage ✅
Checklist
Misc.
Fixes #5951