adsabs / adsws

ADS web services
Other
2 stars 15 forks source link

Bug: user gets error message while trying to reset password #198

Open kelockhart opened 2 years ago

kelockhart commented 2 years ago

Symptoms: The user was trying to reset their password via the UI - they used the usual workflow, but after following the temporary link from the reset email back to BBB and entering a new password, they received the following error upon submitting the form: The current user account (library@XXX) does not have enough capacity to create a new client. Requested: 1.0, Available: -1.0 This error message appears here: https://github.com/adsabs/adsws/blob/0b175ff0960555127ef74985613b3c2439f24a9c/adsws/accounts/views.py#L783

Causes:

How does a user not have a BB token but does have an API token? This user has an old user account, from 2015, with the last login in 2017. We verified that a new BBB token will be created once the user is able to log into BBB successfully.

Are other users affected? Users with an API token with a higher-than-normal rate limit and no BB token (query: select user_id,max(name),max(ratelimit) from oauth2client group by user_id having count(*)=1 order by max(name),max(ratelimit),user_id; - requires some manual selection):

    1752 | ADS API client          |     2.5
     149 | ADS API client          |       3
    1027 | ADS API client          |       5
    1641 | ADS API client          |       5
    3404 | ADS API client          |       5
    4370 | ADS API client          |       5
    4510 | ADS API client          |       5
    1016 | ADS API client          |      10
    3536 | ADS API client          |      10

Users with a BBB token with a higher-than-normal rate limit (not sure if these will be affected or not): query: select users.email, oauth2client.ratelimit from oauth2client inner join users on oauth2client.user_id=users.id where oauth2client.ratelimit>1 and oauth2client.name like 'BB%';:

Solution: Lower the user's rate limit back to 1, and have them proceed with resetting their password. This creates a BBB token for them. Then you can raise the rate limit back up again.

Given the low number of users affected and the easy workaround, this is a low priority bug right now.