Skip to content

fix(test-users): delete test users with the account that created them #5247

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Coread merged 1 commit into from
Sep 28, 2026
Merged

fix(test-users): delete test users with the account that created them #5247

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
47 changes: 20 additions & 27 deletions packages/@webex/test-users/src/index.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
import assert from 'assert';

import uuid from 'uuid';
import btoa from 'btoa';
import _ from 'lodash';
Expand Down Expand Up @@ -280,6 +278,9 @@ export function loginTestUser(options) {
* @returns {Promise}
*/
export function removeTestUser(options = {}) {
const clientId = options.clientId || process.env.WEBEX_CLIENT_ID;
const clientSecret = options.clientSecret || process.env.WEBEX_CLIENT_SECRET;
const idbrokerUrl = options.idbrokerUrl || process.env.IDBROKER_BASE_URL;
const cigServiceUrl =
options.cigServiceUrl ||
process.env.WEBEX_TEST_USERS_CI_GATEWAY_SERVICE_URL ||
Expand All @@ -295,31 +296,23 @@ export function removeTestUser(options = {}) {
return Promise.reject(new Error('options.id is required'));
}

if (!options.token) {
return loginTestUser(options).then((token) => {
options.token = token;

return removeTestUser(options);
});
}

assert(options.token.authorization, 'options.token.authorization must be defined');

return request({
method: 'POST',
json: true,
headers: {
authorization: options.token.authorization,
},
body: {
/* eslint-disable camelcase */
user_id: options.id,
refresh_token: options.token.refresh_token,
user_type: options.userType || 'PERSON',
/* eslint-enable camelcase */
},
uri: `${cigServiceUrl}${BASE_PATH}/delete`,
});
return getClientCredentials({clientId, clientSecret, idbrokerUrl}).then((authorization) =>

@chatgpt-codex-connector chatgpt-codex-connector Bot Sep 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Key cached client tokens by credentials

When one process removes users owned by more than one client, this call can authorize a deletion with the wrong account: getClientCredentials() returns the single module-global clientToken before considering the supplied clientId, clientSecret, or idbrokerUrl. After a user owned by client A has been created or removed, a later removeTestUser({...clientBCredentials}) still sends A's token, so the newly required creator-account authorization rejects deletion of B's user. Cache tokens per credential tuple (or avoid the global cache for this path).

Useful? React with 👍 / 👎.

request({
method: 'POST',
json: true,
headers: {
authorization,
},
body: {
/* eslint-disable camelcase */
user_id: options.id,
refresh_token: options.token && options.token.refresh_token,
user_type: options.userType || 'PERSON',
/* eslint-enable camelcase */
},
uri: `${cigServiceUrl}${BASE_PATH}/delete`,
})
);
}

/**
Expand Down
Loading