Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix HttpError 412 error when provisioning access to GCP resources for users #1822

Merged
merged 5 commits into from Jan 23, 2023

Conversation

alistairewj
Copy link
Member

Recently, we had a few error messages along the lines of:

Exception Type: HttpError at /projects/<project-slug>/<project-version>/request_access/4
Exception Value: <HttpError 412 when requesting https://admin.googleapis.com/admin/directory/v1/groups/<project-gcp-group-email>/members?alt=json returned "Condition not met">

These seem to occur when a user tries to request access to a project on GCP when their cloud e-mail is not a valid Google e-mail. This PR fixes this by:

  1. Catching http errors from the Google Admin API rather than raising a 500
  2. E-mailing the user that the request failed, and notifying them with an error message on the site
  3. Add a special case for the 412 response code - the notification tells the user to verify their cloud e-mail is valid

Copy link
Member

@tompollard tompollard left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks Alistair, looks good to me! Added a couple of minor comments. Do you want to address either of these before we merge?

… user

The grant_aws_open_data_access and grant_gcp_group_access utility functions
return a message if they succeed or fail. The project view was checking this
message against custom strings to determine whether to provide a success or
error modal to inform the user. This commit changes these functions and the
view to use a boolean variable which seems less fragile.
…ess fails

Currently, if the system is unable to grant access to a user e-mail to GCP,
i.e. unable to add their cloud e-mail to a Google Group, the server will
raise an error. Instead, it would be better to notify the user, and provide
some advice on what the cause of the error may be.
… google

Google Admin sometimes returns a 412. It's not 100% clear, but this seems
to happen if the server tries to add a non-Google e-mail to the group.
Typically, this occurs if the user has added a non-Google e-mail in
their cloud profile. This commit adds a notification to hint the user
towards a solution.
@alistairewj
Copy link
Member Author

I refactored the utility functions for clarity and to fix the bug you spotted. The last commit has the changes done in the refactor if you are interested.

It's a bit brittle to require returning correctly within each if block.
Instead, code flow is expected to reach the end of the function, where
the message and boolean access variable are returned.
@tompollard
Copy link
Member

Thanks Alistair, looks good! Hopefully @Chrystinne can do some more cleaning up of this later as part of the AWS integration.

@tompollard tompollard merged commit bdae9ba into MIT-LCP:dev Jan 23, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants