You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Describe the bug
The implementation of the Operational Intent Reference (OIR) deletion endpoint ignores the provided OVN and will delete the OIR in any case.
Expected behavior
The OIR deletion endpoint is expected to only delete the specified OIR if the passed OVN matches the one currently stored for that OIR.
If the OVNs don't match, we would expect a 409, as specified in the astm-utm protocol's OpenAPI spec, and the OIR should not be deleted.
The CR deletion endpoint should behave in the same way.
In addition to the fix itself, we would expect the uss_qualifier to detect when a DSS implementation does not validate OVNs. Enriching the qualifier with the relevant checks is covered by this issue.
Shastick
changed the title
[scd] deletion of operational intent ref. accepts any OVN for deletion.
[scd] deletion of entity ref. accepts any OVN for deletion.
Aug 28, 2024
Describe the bug
The implementation of the Operational Intent Reference (OIR) deletion endpoint ignores the provided OVN and will delete the OIR in any case.
The same issue seems to affect Constraint Reference (CR) deletion.
(Subscriptions, on the other hand, are correctly handled)
Expected behavior
The OIR deletion endpoint is expected to only delete the specified OIR if the passed OVN matches the one currently stored for that OIR.
If the OVNs don't match, we would expect a 409, as specified in the astm-utm protocol's OpenAPI spec, and the OIR should not be deleted.
The CR deletion endpoint should behave in the same way.
In addition to the fix itself, we would expect the uss_qualifier to detect when a DSS implementation does not validate OVNs. Enriching the qualifier with the relevant checks is covered by this issue.
Additional context
Originally described by @BenjaminPelletier in this issue
The text was updated successfully, but these errors were encountered: