Deployment ownership

The panel keeps the owner of each deployment. These sections tell how the panel identifies a deployment to the API, and what happens to the deployments of an account when the account is removed.

Deployment identifiers

The API addresses deployments by an opaque identifier: str(pk) of the Deployment, a lowercase UUID. A deployment with pk 0b9c2f3e-5d1a-4c7b-9e8f-1a2b3c4d5e6f is POST /deployments/submit/0b9c2f3e-5d1a-4c7b-9e8f-1a2b3c4d5e6f in API URLs, and maps to the Centrifugo channel fediversity.deployments.0b9c2f3e-5d1a-4c7b-9e8f-1a2b3c4d5e6f. Ownership stays in the panel's database (Deployment.operator), so a user name is not part of an identifier, and a change of a user name keeps the deployments of the user. The bearer tokens for api name the user by User.pk. The callback sub names the user by the OpenID Connect sub of the account, with the issuer as iss, or by User.pk for an account without single sign-on. A trusted backend names the user by User.username in X-On-Behalf-Of.

The panel's three Centrifugo proxy views (CentrifugoConnect, CentrifugoSubscribe and CentrifugoPublish) enforce ownership: a subscribe request for fediversity.deployments.<pk> is allowed only when <pk> is, in exactly the form str(pk), a deployment of the Django session user. The authz callback for api (AuthzCallback) checks a deployment_id the same way. It allows a list (GET /deployments?id=...) only when the call names one or more ids and each one is a deployment of the requester, with one query for all ids.

Account removal

The removal of an account (in the admin, or with User.delete) first queues, through DELETE /deployments/{id} on api/, the destroy of each deployment of the account, and then removes the account and its deployments. api/ answers 404 for a deployment that it does not know, which is a success. Any other answer, or no answer, stops the removal: the account and its deployments stay, the panel logs the error, and the admin shows it.

The removal does not wait for the destroy builds to finish. A destroy build that fails after the removal shows only in api/, in the status and the log of that build.