server: proper error handling in sessions API #78176
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
This change is |
knz
approved these changes
Mar 21, 2022
maryliag
approved these changes
Mar 21, 2022
complete! 1 of 0 LGTMs obtained
Fixes cockroachdb#76288 Previously, part of the code in the sessions API that handles privelege checking would swallow non-privelege related server errors. The function `requireViewActivityOrViewActivityRedactedPermission` was being used to check if the user has either of the above roles. This function returns an error as a single value, which can be either a privelege or non-privelege related error. It is intended for use when either role is required to use the API, with the error returned immediately, however the sessions API is should work for users without these permissions if given the correct request parameters. This commit replaces the use of `requireViewActivityOrViewActivityRedactedPermission` with `hasRoleOption` to check for the possession of the VIEWACTIVITY or VIEWACTIVITYREDACTED roles. This allows us to use both the result of the role check and return errors encountered immediately. Release justification: bug fix Release note: None
xinhaoz
force-pushed
the
sessions-error-handling
branch
from
6a32a21 to
3c0aaa1
Compare
|
TFTR! + thanks for adding the backport label, Marylia. |
|
Build failed (retrying...): |
|
Build succeeded: |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #76288
Previously, part of the code in the sessions API that handles
privelege checking would swallow non-privelege related server
errors. The function
requireViewActivityOrViewActivityRedactedPermissionwas being used to check if the user has either of the above
roles. This function returns an error as a single value, which
can be either a privelege or non-privelege related error.
It is intended for use when either role is required to use the API,
with the error returned immediately, however the sessions API is
should work for users without these permissions if given the
correct request parameters.
This commit replaces the use of
requireViewActivityOrViewActivityRedactedPermissionwithhasRoleOptionto check for the possession of the VIEWACTIVITYor VIEWACTIVITYREDACTED roles. This allows us to use both the
result of the role check and return errors encountered immediately.
Release note: None