Hacktoberfest 2026: die Issues, die Maintainer für den Oktober markiert haben – offen und einsteigerfreundlich. Hacktoberfest-Issues durchsuchen

Publish fails on workspace products with the built-in administrators group

Offen
  • Stimmt etwas nicht?
#328 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Maintainer antworten meist innerhalb von 3 Tagen

Dieses Issue hat noch niemand übernommen.

Bewertung

Schwierigkeit
4/5
Geschätzter Aufwand
3-5 Tage
Anfängerfreundlichkeit
48/100
Issue-Typ
Bug
Klarheit
Größtenteils klar
Aktivitätsstatus
Aktiv
Tech-Stack
azure, typescript
Bereich
backend, cli

Rechercherichtung

Start by tracing the publish path that reads products/*/groups.json and issues the ProductGroup link PUT, then compare it with cleanupProductGroups() and the existing versus new product paths described in the issue. Reproduce with a workspace product containing the built-in administrators group and inspect the target association after publishing. Done means publish succeeds with documented workspace collaborator permissions while preserving the relevant source and target state.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

type:bug
Command that triggered the bug

apiops publish

Expected behavior

apiops publish should handle a workspace product's service-scoped administrators group association without failing the publish or requiring permissions beyond the documented workspace collaborator roles.

The supported behavior should preserve the relevant source/target state. We have not verified whether APIM attaches this group to target workspace products automatically, so simply skipping the PUT may or may not preserve the association.

Actual behavior

Workspace products can have the built-in administrators group recorded in groups.json after apiops extract.

When publishing to a target workspace, the CLI attempts to PUT this ProductGroup link. With our publishing identity's permissions, this fails:

HTTP 403: LinkedAuthorizationFailed — client has 'groupLinks/write' on
workspaces/.../products/{product}/groupLinks/administrators but does not have
'Microsoft.ApiManagement/service/groups/write' on the linked scope .../groups/administrators

Microsoft recommends a service-scoped workspace companion role alongside the workspace role. However, neither API Management Service Workspace API Developer nor API Management Service Workspace API Product Manager grants Microsoft.ApiManagement/service/groups/write, the permission demanded by this error. This appears to require permissions beyond the documented workspace collaborator roles.

In our tests, this is a hard ERROR and causes exit code 1, even when every other resource publishes successfully. Extraction is unaffected.

The failure also occurs when republishing an existing product. v1.0.5's cleanupProductGroups() does not address that case because it only runs when !productExisted.

Our current workaround strips administrators entries from products/*/groups.json before publishing. This avoids the error, but we have not verified whether it preserves the association on the target.

apiops CLI version

1.0.5

Environment details
  • Execution environment: Azure DevOps, Linux agent
  • Node.js: v22.23.3
  • Shell: Bash
  • Azure CLI: 2.90.0
  • Publish task: AzureCLI@2, task version 2.279.1
  • Authentication: service principal
  • APIM scope: workspace-scoped products
  • Publish modes: reproduced with both incremental and full publishing
CI/CD environment

Azure DevOps

Is this bug blocking you?

None

Vorherrschende Sprache
TypeScript
Sterne
34
Forks
13
Ø Merge
3 T. 6 Std.
Gemergte PRs (30 T.)
7

Entwicklungsumgebung

In Codespaces öffnen

Startet den Dev-Container des Projekts im Browser, mit Ihrem eigenen GitHub-Konto.

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus Azure/apiops-cli

Alle Issues in Azure/apiops-cli

Ähnliche Issues

Weitere Issues zu TypeScript

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.