Improve error messages on names registration and usage to separate some cases
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
Snap Store Server |
New
|
Undecided
|
Unassigned |
Bug Description
When trying to use a charm that the user doesn't have permissions, the result is "Name NAME not found in the charm namespace" (code 'resource-
This gives the user the impression that NAME is not registered yet, but then when trying to register it it receives "Name NAME is already registered" (code 'already-
We think we can improve the user experience in two ways:
1. provide errors distinguishing the case of "the charm does not exists" than "the charm exists but you don't have credentials to see it"
2. provide errors distinguishing the case of "the charm name is already registered" than "the charm name is reserved"
This idea was originated in this Charmcraft request:
https:/
Thank you!!
It's definitely unacceptable from a security perspective to provide an oracle for whether a charm exists that you're not allowed to see. We could potentially justify distinguishing reserved and already registered, but it would need some thinking around security.