Trying to install a snap with a price without purchasing it gives a "unexpected http response code (404)" message

[Daniel Manrique]

$ snap --version
snap 2.30
snapd 2.30
series 16
ubuntu 17.10
kernel 4.13.0-25-generic

How to reproduce:

snap install some-snap

where some-snap is a snap which has a price set, and which the current user has NOT bought, nor are they the publisher or a collaborator. The best way to test this is to publish the snap with one user account, and then try to install it with a snapd logged into a different, totally-unprivileged user account.

What I expected to happen:
- Some friendly message saying "you need to buy this snap before installing it, try 'snap buy some-snap'" or something similar.

What happened:

ERROR received an unexpected http response code (404) when trying to download https://api.snapcraft.io/api
/v1/snaps/download/<the_snap_id>_1.snap

I set my snapd to debug and log stuff, I noticed snapd queries the orders endpoint:

GET /api/v1/snaps/purchases/orders

but then proceeds with trying to download the snap:

GET /api/v1/snaps/download/<the_snap_id>_1.snap

the json response from orders clearly indicates whether the snap has been bought, and is thus downloadable. So I think snapd is neglecting to consider the order status for paid snaps prior to attempting the download (or failing with a suitable message).

the doDownloadSnap function/task would be one place where this check could be done, or maybe in doInstall, which is what eventually queues doDownloadSnap.

The query to orders endpoint is used to set a property on a snap's Info, MustBuy. so if the snap is priced but hasn't been bought, MustBuy will be true. I didn't find anywhere in the code where this is checked; this is what could be checked by doInstall (or earlier/later).

Take all my reading of snapd code with a grain of salt, as I'm not too familiar with it :)

[Samuele Pedroni (pedronis)]

there is code in snapd that would produce a better error message for 402, sounds when this was coded that was the expectation to get that in some case, but I was not directly involved,

not all uses of the API will consult /api/v1/snaps/purchases/orders

snapd can do better but the store could also return a more appropriate status code

[Michael Vogt (mvo)]

Adding the snapstore for better status codes.