Publish fails on workspace products with the built-in administrators group

Aperta
  • Qualcosa non va?
#328 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 3 giorni

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
48/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
azure, typescript
Ambito
backend, cli

Direzione di ricerca

Start by tracing the publish path that reads products/*/groups.json and issues the ProductGroup link PUT, then compare it with cleanupProductGroups() and the existing versus new product paths described in the issue. Reproduce with a workspace product containing the built-in administrators group and inspect the target association after publishing. Done means publish succeeds with documented workspace collaborator permissions while preserving the relevant source and target state.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

type:bug
Command that triggered the bug

apiops publish

Expected behavior

apiops publish should handle a workspace product's service-scoped administrators group association without failing the publish or requiring permissions beyond the documented workspace collaborator roles.

The supported behavior should preserve the relevant source/target state. We have not verified whether APIM attaches this group to target workspace products automatically, so simply skipping the PUT may or may not preserve the association.

Actual behavior

Workspace products can have the built-in administrators group recorded in groups.json after apiops extract.

When publishing to a target workspace, the CLI attempts to PUT this ProductGroup link. With our publishing identity's permissions, this fails:

HTTP 403: LinkedAuthorizationFailed — client has 'groupLinks/write' on
workspaces/.../products/{product}/groupLinks/administrators but does not have
'Microsoft.ApiManagement/service/groups/write' on the linked scope .../groups/administrators

Microsoft recommends a service-scoped workspace companion role alongside the workspace role. However, neither API Management Service Workspace API Developer nor API Management Service Workspace API Product Manager grants Microsoft.ApiManagement/service/groups/write, the permission demanded by this error. This appears to require permissions beyond the documented workspace collaborator roles.

In our tests, this is a hard ERROR and causes exit code 1, even when every other resource publishes successfully. Extraction is unaffected.

The failure also occurs when republishing an existing product. v1.0.5's cleanupProductGroups() does not address that case because it only runs when !productExisted.

Our current workaround strips administrators entries from products/*/groups.json before publishing. This avoids the error, but we have not verified whether it preserves the association on the target.

apiops CLI version

1.0.5

Environment details
  • Execution environment: Azure DevOps, Linux agent
  • Node.js: v22.23.3
  • Shell: Bash
  • Azure CLI: 2.90.0
  • Publish task: AzureCLI@2, task version 2.279.1
  • Authentication: service principal
  • APIM scope: workspace-scoped products
  • Publish modes: reproduced with both incremental and full publishing
CI/CD environment

Azure DevOps

Is this bug blocking you?

None

Lingua principale
TypeScript
Stelle
37
Fork
14
Merge medio
3g 6h
PR unite (30g)
7

Preparare l'ambiente

Apri in Codespaces

Avvia il container di sviluppo del progetto nel browser, con il tuo account GitHub.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di Azure/apiops-cli

Tutte le issue di Azure/apiops-cli

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.