Skip to content

Resolve "Error 500 when trying to destroy OAuth application entry in admin area"

What does this MR do?

Fix for #23746 (closed)

Why?

A missing on_delete: :cascade constraint on the oauth_openid_requests table is currently causing trouble when deleting applications from the Admin area.

This is because

  1. On deleting an application, all of its related access_grants records are deleted by delete_all callback (https://github.com/doorkeeper-gem/doorkeeper/blob/v4.3.1/lib/doorkeeper/orm/active_record/application.rb#L8)

  2. Since a delete_all callback is executed, the dependent: :delete callback on it's corresponding oauth_openid_request record on access_grants do not run. (https://github.com/doorkeeper-gem/doorkeeper-openid_connect/blob/v1.5.0/lib/doorkeeper/openid_connect/orm/active_record/access_grant.rb#L9)

  3. Since this callback does not run and access_grant records are forced to be deleted, the existing foreign_key constraint on
    oauth_openid_request gives error like:

Screenshot_2019-11-07_at_1.23.12_PM

Fix

By adding the foreign_key constraint on_delete: :cascade, we can solve this problem.

Screenshots

Does this MR meet the acceptance criteria?

Conformity

Availability and Testing

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

  • Label as security and @ mention @gitlab-com/gl-security/appsec
  • The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • Security reports checked/validated by a reviewer from the AppSec team

Merge request reports