1226597 - Error message when scopes are not satisfied is confusing

Status: RESOLVED FIXED

(Taskcluster Graveyard :: Scheduler, defect)

Description

[(not currently active) Ted Mielczarek]

I have code that's calling createTaskGraph, and I had to update the scopes in my task graph due to recent security tightening. While I was trying to get this fixed, the error messages from the scheduler was not very helpful:
```
{
    "error": {
        "info": "None of the scope-sets was satisfied",
        "scopes": [ < big list of scopes I have ],
        "scopesets": [
            [
                < scopes specified in my task graph definition >
            ]
        ]
    },
    "message": "Authorization Failed"
}
```

Ideally, since I'm just passing a simple list of scopes, it could tell me "you don't have this scope". At one point I typoed a scope name and got this error, and it took some puzzling before I figured it out.

Comment 1

[Pete Moore [:pmoore][:pete]]

The "missing" scopes are mostly what the user cares about, and this can be considered to be a reduction of the original scopesets.

If you take the scopesets, and you remove all given scopes, you will end up with the missing scopes described as a scopeset.

We could include this information in the error message.

Example:

(given/assigned) scopes:
'abc', 'd*', 'ABC', 'G*'

(required) scopesets:
[['abc' and 'ghi'] or ['abc' and 'd34' and 'abc/def'] or ['ABC' and 'ghi' and 'A*']]

The missing scopes would be computed by removing all entries in scopesets that match are matched by any of the given scopes.

Result:
[['ghi'] or ['abc/def'] or ['ghi' and 'A*']]

So the error message could say something like:

> The scopesets were not satisfied. The following scopes are required:
> [['ghi'] or ['abc/def'] or ['ghi' and 'A*']]

We can work on the wording - I just wanted to highlight here we can construct a representation of the "missing scopes" by applying a simple reduction process against the original scopesets - and this is probably the useful information for the user in order for them to resolve the matter. Currently we do not show a representation of "the gap" between what scopes are given and those that are required.

Comment 2

[Pete Moore [:pmoore][:pete]]

The other key point of course in improving the error message is to represent the scope sets introducing the words "and" and "or" in the appropriate places, so that the message can easily be understood, and a user does not need how to translate an array of arrays into a logical expression.

Comment 3

[Jonas Finnemann Jensen (:jonasfj)]

Will be fixed along with bug 1141639

Comment 6

[Selena Deckelmann :selenamarie :selena]

Is the error message better now?

Comment 7

[Jonas Finnemann Jensen (:jonasfj)]

Fixed this a while ago...

--
This bug is closed as part of the Great Bugzilla Cleaning Sprint of 2016 by bstack and jonasfj, please reopen if you disagree.