Org scoped searches disagree on what a deleted organization means
Los mantenedores suelen responder en 1 día
Nadie ha tomado este issue todavía.
Evaluación
- Dificultad
- 4/5
- Tiempo estimado
- 3-5 días
- Aptitud para principiantes
- 68/100
Línea de trabajo
Trace the handlers and aggregate services for the invoice and token RPCs first to find where their 404 responses originate, then compare that path with the other org-scoped searches and OrganizationRepository.Delete. Make every listed search resolve the organization consistently and return 404 when absent while retaining the SQL live(organizations) checks; verify the behavior for all affected RPCs.
Escrito por el modelo de indexación a partir del texto del issue.
Descripción
The problem
Asking an org scoped search about an organization that is gone gives different answers depending on which RPC you call. A client cannot tell "this organization does not exist" apart from "this organization has nothing to show".
We want 404 not found everywhere.
Where things stand today
Verified by reading the handlers and services:
| RPC | Today | How |
|---|---|---|
SearchOrganizationServiceUsers |
404 | The handler calls orgService.GetRaw first, which reads live rows only |
SearchOrganizationUsers |
200, empty list | After #1953 the SQL filters the organization out |
SearchOrganizationProjects |
200, empty list | After #1953 the SQL filters the organization out |
SearchUserProjects |
200, empty list | After #1953 the SQL filters the organization out |
SearchOrganizationPATs |
200, with rows | No check anywhere. See the comment on #1953 |
SearchOrganizationInvoices |
404 | Needs confirming, see below |
SearchOrganizationTokens |
404 | Needs confirming, see below |
The end to end run in #1952 reported 404 for invoices and tokens. But neither handler nor either aggregate service resolves the organization. So something upstream is doing it, and part of this work is finding out what. If it turns out to be a shared path, that path may be the right place to fix all of them at once.
What to do
- Find out where the 404 for invoices and tokens comes from.
- Pick one way for every org scoped search to resolve the organization before running the query, and answer 404 when it is not there. Reuse whatever invoices and tokens already go through if that turns out to be shared.
- Apply it to
SearchOrganizationUsers,SearchOrganizationProjects,SearchUserProjectsandSearchOrganizationPATs. - Keep the SQL level
live(organizations)checks from #1953 as well. They are cheap and they guard the case where a policy row outlives its organization.policies.resource_idhas no foreign key toorganizations, so a hard deleted organization does leave membership policies behind.
Why it matters
Today OrganizationRepository.Delete is a hard delete and nothing sets deleted_at on organizations, so the split is mostly invisible. It will stop being invisible the moment organizations get a soft delete. Better to settle it now while the blast radius is small.
Related
- #1953 added the SQL level checks for three of these searches
- #1952 changed how a bad organization id is reported, which is what surfaced the split
- Lenguaje dominante
- Go
- Estrellas
- 344
- Forks
- 47
- Merge medio
- 2 d 20 h
- PR fusionados (30 d)
- 39
Preparar el entorno
Aún no hemos revisado los archivos de configuración de este proyecto. Empieza por su README y consulta nuestra guía para la primera contribución para los pasos generales.
Primeros pasos
- Lee el issue completo y luego la guía de contribución del proyecto.
- Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
- Haz un fork del repositorio y trabaja en una rama.
- Abre un pull request que haga referencia al número del issue.
Más de raystack/frontier
-
Dificultad 4/5 3-5 días Aptitud para principiantes 58/100
Los mantenedores suelen responder en 1 día
-
authz bug
Dificultad 3/5 1-2 días Aptitud para principiantes 70/100
raystack/frontier#1896 · 1 comentario ·
Los mantenedores suelen responder en 1 día
-
Add OpenTelemetry tracingAbierto
Dificultad 5/5 Más de una semana Aptitud para principiantes 45/100
Los mantenedores suelen responder en 1 día
-
Dificultad 5/5 Más de una semana Aptitud para principiantes 38/100
Los mantenedores suelen responder en 1 día
-
Dificultad 3/5 1-2 días Aptitud para principiantes 75/100
Los mantenedores suelen responder en 1 día
Todos los issues de raystack/frontier
Issues similares
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 90/100
Los mantenedores suelen responder en 1 día
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 76/100
NVIDIA/k8s-device-plugin#2076 ·
Los mantenedores suelen responder en 1 día
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 84/100
Los mantenedores suelen responder en 1 día
-
agentic-workflows
Dificultad 2/5 1-3 horas Aptitud para principiantes 68/100
Los mantenedores suelen responder en 1 día
-
area/release kind/bug
Dificultad 2/5 1-3 horas Aptitud para principiantes 82/100
kubernetes-sigs/kueue#16455 · 1 comentario ·
Los mantenedores suelen responder en 1 día