stacklok / minder / 8694895516

53%

Build Type

push

github

Committed by web-flow

Commit Message

Do not delete user from OpenFGA in a DB transaction to avoid issues with minder auth delete (#3082)

* Do not delete user from OpenFGA in a DB transaction to avoid issues with minder auth delete

We've been occasionally hitting issues where `minder auth delete` would
delete the user entry but leave the project around. Recovering from this
state then requires database write permissions to manually clean up the
projects.

At least in the case that I reproduced by accident the flow went like
this:
- user issues auth delete
- the transaction starts
- the user projects are returned and contain a non-empty list
- the user entry is deleted from OpenFGA
- the user entry is staged for deletion from the DB as part of the
  transaction
- one of the projects are attempted to be deleted, but the deletion
  fails. This error rolls back the transaction and deleting the user.
- the end-user gets an error message, thinks 'a fluke' and runs auth
  delete again
- the new run starts, calls list project for user from OpenFGA which
  returns an empty list
- the user is deleted from the db and the transaction is commited
- the project are left behind because openFGA returned none for the user
  because as far as openFGA knows the user is gone
- the next auth login can't create the project for the user

This patch reorganizes the `DeleteUser` flow is such a way that if the
all the database operations are wrapped in a transaction, but the
OpenFGA delete user call is kept outside; the list of projects before the
transaction and deleting the user entry after it.

The call to delete unmanaged projects is changed so that only the
projects that have other subjects than the one being deleted are
deleted.

* code review suggestions

Run Details

28 of 35 new or added lines in 2 files covered. (80.0%)

1 existing line in 1 file now uncovered.

8290 of 17229 relevant lines covered (48.12%)

37.4 hits per line