View Issue Details

IDProjectCategoryView StatusLast Update
0010765Talermerchant backendpublic2025-12-15 19:34
Reportersebasjm Assigned ToChristian Grothoff  
PrioritynormalSeverityminorReproducibilityhave not tried
Status confirmedResolutionopen 
Product Version1.1 
Target Version1.5 
Summary0010765: backend refuses to delete an instance without the owner permission
Descriptioncreate an instance with self provision
logout and login as an admin
try to delete the instance

expected: instance gets deleted
current: it ask for email/sms verification

i think this is a major problem because it would mean that the only way i can claim my disk space again is by going directly to the db
TagsNo tags attached.

Activities

Christian Grothoff

2025-12-11 20:53

manager   ~0026890

Major: no. but should be fixed.

Christian Grothoff

2025-12-12 21:12

manager   ~0026943

Eh, quick question: is it asking for the admin's 2FA, or for the instance 2-FA? I think if it asked for the admin's 2-FA credentials, this might be totally OK!

sebasjm

2025-12-15 19:31

developer   ~0026994

I tested again. Starting from scratch, clean db and config

[merchant]
MANDATORY_TAN_CHANNELS = email

created the admin instrance without email
created and deleted an instance with name "qwe", didn't required email and didn't asked for MFA (which is ok)

finally I created an instance with name "asd" and email "asd@asd.com" with self provision and proceeded to delete

upon deletion the admin was asked solve MFA


$ curl 'http://merchant.taler.test/management/instances/asd?purge=NO' -X 'DELETE'
{
  "combi_and": false,
  "challenges": [
    {
      "tan_info": "asd",
      "tan_channel": "email",
      "challenge_id": "9-GYEF8A3KSQWK5PC1PKB6KYSWM1BZE92N6CHZJ2BXFDG2C0QJQ940"
    }
  ]
}

sebasjm

2025-12-15 19:34

developer   ~0026995

And the my TAN scripts logs the email that was used.

2025/12/15_15:22:56 asd@asd.com "96504243\nTaler-Merchant:\ncreate new instance"
2025/12/15_15:23:52 asd@asd.com "62580310\nTaler-Merchant:\ndelete instance"

Also the admin instance didn't have email

Issue History

Date Modified Username Field Change
2025-12-11 18:09 sebasjm New Issue
2025-12-11 18:09 sebasjm Status new => assigned
2025-12-11 18:09 sebasjm Assigned To => Christian Grothoff
2025-12-11 20:53 Christian Grothoff Note Added: 0026890
2025-12-11 20:54 Christian Grothoff Severity major => minor
2025-12-11 20:54 Christian Grothoff Product Version => 1.1
2025-12-11 20:54 Christian Grothoff Target Version => 1.5
2025-12-12 21:12 Christian Grothoff Note Added: 0026943
2025-12-12 21:13 Christian Grothoff Assigned To Christian Grothoff => sebasjm
2025-12-12 21:13 Christian Grothoff Status assigned => feedback
2025-12-15 19:31 sebasjm Note Added: 0026994
2025-12-15 19:34 sebasjm Note Added: 0026995
2025-12-15 19:34 sebasjm Assigned To sebasjm => Christian Grothoff
2025-12-15 19:34 sebasjm Status feedback => confirmed