search

opentdf / platform

Persistent data centric security that extends owner control wherever data travels
BSD 3-Clause Clear License
19 stars 11 forks source link

Policy API: No attribute definition ID existence validation on performing Update requests. #569

Closed sievdokymov-virtru closed 4 months ago

sievdokymov-virtru commented 7 months ago

'0 OK' successful response is returned on performing Update entity requests (e.g. UpdateAttribute) if use non-existed id value (quite confusing since it doesn’t affect database and doesn’t provide proper feedback for an operation containing e.g. id mistake)

Steps to Reproduce:

  1. Run the backend server for the opened/platform (as described in the Readme).
  2. Create a Namespace and an Attribute.
  3. Perform AttributeService.UpdateAttributeValue gRPC request with filling required parameters but use not existed id value.
  4. Invoke the request and observe response.

Actual Result: Request unexpectedly passes and returns “0 OK” success code in response which may mislead user:

WrongId

Expected Result: Request should fail with “3 INVALID_ARGUMENT” response to give a feedback that irrelevant id was used and may require some corrections.

Additional Info: id validation is performed properly e.g. on Deactivate Entity requests or when using parental entity ids in Create requests etc.

Correspondent JIRA issue: https://virtru.atlassian.net/browse/PLAT-3116

jakedoublev commented 4 months ago

When I run through this scenario, it appears this is now resolved. Please reopen if you're able to reproduce @sievdokymov-virtru.