eik-lib / issues

All Eik issues, bugs, questions etc goes here. Documentation is to be found at https://eik.dev
1 stars 0 forks source link

npx eik package-alias allows setting alias to non existant version #10

Closed hennikul closed 2 years ago

hennikul commented 2 years ago

Short description: When running npx eik package-alias user 0.13.31 0 and no version 0.13.31 existing in Eik, the output indicates that this is not allowed and that nothing happens, but in reality the alias v0 is updated to a non existing version resulting in 404 when used in import-maps.

Expected behaviour: Output remains "The server was unable to locate the required resource", but alias is not updated to non existing version.

Full description: We had an incident in our production environment yesterday resulting from a series of unfortunate events. Our first problem was that a module that should have been named @amedia/user in Eik was previously named user, and an alias had been created with version 0, and this was used in import-maps in two of our applications.

When creating a new version of this module, our npm publish step uploaded @amedia/user version 0.13.31. Our documentation said that we should run this command: npx eik package-alias user 0.13.31 0

The output of this command was:

   ╭───────────────────────╮
   │                       │
   │   Eik CLI (v1.8.42)   │
   │                       │
   ╰───────────────────────╯

⚠ The server was unable to locate the required resource

So this looks like a noop, and the fix was to run npx eik package-alias @amedia/user 0.13.31 0, which shows clearly that the alias for @amedia/user v0 is updated in Eik to version 0.13.31. We updated our documentation and use of wrong module name in import-maps, since this was clearly a bug in our end.

But then stuff started breaking in production. While waiting for new builds with fixed import-maps, the old alias for 'user' started failing in production. First with 503 errors, and later with 404. We did not initially understand what was going on, since our understanding was that only @amedia/user v0 had been successfuly updated. Rolling out new builds fixed the situation, and we later understood that the updated of 'user' had actually updated v0 to 0.13.31 even though the output indicated that it didn't do anything. Since no version 0.13.31 existed of 'user', this alias failed in user's browsers.

mfolkeseth commented 2 years ago

https://github.com/eik-lib/core/pull/277