fix: ignore 403 while deleting namespaces (#771)

controller/tenants_test.go

@@ -161,7 +161,7 @@ func (s *TenantsControllerTestSuite) TestSuccessfullyDeleteTenants() {
 			HasNoNamespace()
 	})
 
-	s.T().Run("ok even if namespace missing", func(t *testing.T) {
+	s.T().Run("ok even if namespace missing while returning 404", func(t *testing.T) {
 		// if the namespace record exist in the DB, but the `delete namespace` call on the cluster endpoint fails with a 404
 		// given
 		defer gock.OffAll()
@@ -190,6 +190,35 @@ func (s *TenantsControllerTestSuite) TestSuccessfullyDeleteTenants() {
 			HasNoNamespace()
 	})
 
+	s.T().Run("ok even if namespace missing while returning 403", func(t *testing.T) {
+		// if the namespace record exist in the DB, but the `delete namespace` call on the cluster endpoint fails with a 403
+		// given
+		defer gock.OffAll()
+		testdoubles.MockCommunicationWithAuth(test.ClusterURL)
+		gock.New(test.ClusterURL).
+			Delete("/oapi/v1/projects/bar-che").
+			SetMatcher(test.ExpectRequest(test.HasJWTWithSub("devtools-sre"))).
+			Reply(403).
+			BodyString(`{"kind":"Status","apiVersion":"v1","metadata":{},"status":"Forbidden"}`)
+		gock.New(test.ClusterURL).
+			Delete("/oapi/v1/projects/bar").
+			SetMatcher(test.ExpectRequest(test.HasJWTWithSub("devtools-sre"))).
+			Reply(200).
+			BodyString(`{"kind":"Status","apiVersion":"v1","metadata":{},"status":"Success"}`)
+
+		fxt := tf.FillDB(t, s.DB, tf.AddSpecificTenants(tf.SingleWithName("bar")), tf.AddNamespaces(environment.TypeUser, environment.TypeChe))
+		id := fxt.Tenants[0].ID
+
+		svc, ctrl, reset := s.newTestTenantsController()
+		defer reset()
+		// when
+		goatest.DeleteTenantsNoContent(t, createValidSAContext("fabric8-auth"), svc, ctrl, id)
+		// then
+		assertion.AssertTenantFromService(t, repo, id).
+			DoesNotExist().
+			HasNoNamespace()
+	})
+
 	s.T().Run("ok when unsupported namespaces exist in DB", func(t *testing.T) {
 		// given
 		defer gock.OffAll()

openshift/callback.go

@@ -249,7 +249,7 @@ var IgnoreWhenDoesNotExistOrConflicts = AfterDoCallback{
 		return func(context CallbackContext) (*Result, error) {
 			result, err := previousCallback(context)
 			code := result.Response.StatusCode
-			if code == http.StatusNotFound || code == http.StatusConflict {
+			if isNotPresent(code) || code == http.StatusConflict {
 				// todo investigate why logging here ends with panic: runtime error: index out of range in common logic
 				logrus.WithFields(map[string]interface{}{
 					"action":      context.Method.action,

openshift/callback_test.go

@@ -322,6 +322,18 @@ func TestIgnoreWhenDoesNotExist(t *testing.T) {
 		assert.Empty(t, callbackResult)
 	})
 
+	t.Run("when there is 403, then it ignores it even if there is an error", func(t *testing.T) {
+		// given
+		result := openshift.NewResult(&http.Response{StatusCode: http.StatusForbidden}, []byte{}, fmt.Errorf("forbidden"))
+
+		// when
+		callbackResult, err := openshift.IgnoreWhenDoesNotExistOrConflicts.Create(newAfterCallbackFunc(result, fmt.Errorf("forbidden")))(callbackContext)
+
+		// then
+		assert.NoError(t, err)
+		assert.Empty(t, callbackResult)
+	})
+
 	t.Run("when there is 409, then it ignores it even if there is an error", func(t *testing.T) {
 		// given
 		result := openshift.NewResult(&http.Response{StatusCode: http.StatusConflict}, []byte{}, fmt.Errorf("conflict"))