Skip to content

fix: do not allow operator token from being deleted (#26418)#26420

Merged
praveen-influx merged 1 commit into3.0from
3_0/praveen/fix-operator-token-delete
May 15, 2025
Merged

fix: do not allow operator token from being deleted (#26418)#26420
praveen-influx merged 1 commit into3.0from
3_0/praveen/fix-operator-token-delete

Conversation

@praveen-influx
Copy link
Copy Markdown
Contributor

  • fix: do not allow operator token from being deleted

closes: https://github.com/influxdata/influxdb_pro/issues/819

  • refactor: address PR feedback

  • fix: add a word and clarifying colon

  • fix: failing test


Co-authored-by: Peter Barnett peter.barnett03@gmail.com

commit hash in main: b404e84

* fix: do not allow operator token from being deleted

closes: influxdata/influxdb_pro#819

* refactor: address PR feedback

* fix: add a word and clarifying colon

* fix: failing test

---------

Co-authored-by: Peter Barnett <peter.barnett03@gmail.com>

commit hash in main: b404e84
@praveen-influx praveen-influx requested a review from a team May 15, 2025 10:36
Copy link
Copy Markdown
Contributor

@hiltontj hiltontj left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it is worth having this released in a 3.0.3:

  1. it prevents someone from cutting themselves
  2. keeps core/enterprise at the same version

@praveen-influx praveen-influx merged commit 4383a60 into 3.0 May 15, 2025
12 checks passed
if token_name == "_admin" {
println!(
"The operator token \"_admin\" is required and cannot be deleted. To regenerate an operator token, use: influxdb3 create token --admin --regenerate --token [TOKEN]"
);
Copy link
Copy Markdown
Contributor

@jdstrand jdstrand May 15, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@praveen-influx - the spec does not say whether the 'name' of a token is immutable or mutable. I recall thinking that since the actual operations under the hood would be on the immutable 'id', then names would be mutable.

If names are immutable, this if token_name == "_admin" is ok. If they are not, or we plan to change them in the future, this could be a problem. If they are (or we want them to become) mutable, we should:

  • not allow the operator token (named _admin) to be renamed
  • not allow duplicate token names (do we already enforce this?)

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

not allow duplicate token names (do we already enforce this?)

Yes this is enforced.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If they are (or we want them to become) mutable, we should:

  • not allow the operator token (named _admin) to be renamed

When we allow changing the token names (i.e update feature issue), operator token will not be mutable

  • not allow duplicate token names (do we already enforce this?)

This is already enforced in the model (names are unique)

@hiltontj hiltontj deleted the 3_0/praveen/fix-operator-token-delete branch May 15, 2025 17:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants