ocdp-go/docs/bugs-user-b.md

Bug Report: test-user-b QA Test

Tester: test-user-b (user role) Date: 2026-05-11 Environment: http://10.6.80.114:18080

---

Bug 1: Repository Tags Endpoint Returns 404

Endpoint: GET /api/v1/registries/{registryId}/repositories/{repository}/tags Status Code: 404 Response Body: 404 page not found (plain text, not JSON)

Expected: Should return a list of tags for the chart/artifact. Actual: The dedicated tags endpoint is not implemented or routes incorrectly. The artifacts endpoint (/repositories/{repository}/artifacts) does work and returns tag info.

Severity: Medium — tags are still discoverable via artifacts endpoint but the dedicated tags API is broken.

---

Bug 2: DELETE Instance Returns Empty Response Body

Endpoint: DELETE /api/v1/clusters/{clusterId}/instances/{instanceId} Status Code: 200 Response Body: (empty — no content at all)

Expected: Should return a confirmation JSON body (e.g., {"message": "Instance deletion initiated", "id": "..."}) or at minimum a 202 Accepted with status details.

Actual: Returns a completely empty body. The instance does transition to pending-delete state, but the API consumer receives no feedback.

Severity: Medium — operation works but API consumer gets no confirmation.

---

Bug 3: Cluster Stats Endpoint Returns 404

Endpoint: GET /api/v1/clusters/{clusterId}/stats Status Code: 404 Response Body: 404 page not found (plain text)

Expected: Should return cluster resource statistics (CPU, memory, pod counts, etc.) or a proper JSON error if not implemented.

Actual: Endpoint is not implemented — returns a raw 404 with no JSON error structure.

Severity: Low — but given the user has monitoring:clusters:view permission, this is a missing feature.

---

Bug 4: Kubeconfig Endpoint Returns 404

Endpoint: GET /api/v1/clusters/{clusterId}/kubeconfig Status Code: 404 Response Body: 404 page not found (plain text)

Expected: Should return a kubeconfig file content or JSON error. User has kubeconfig:issue:own permission.

Actual: Endpoint is not implemented.

Severity: Low — the permission exists but the endpoint does nothing.

---

Bug 5: Monitoring Metrics Endpoint Returns 404

Endpoint: GET /api/v1/monitoring/clusters/{clusterId}/metrics Status Code: 404 Response Body: 404 page not found (plain text)

Expected: Monitoring metrics data. User has monitoring:clusters:view permission.

Actual: Endpoint not found.

Severity: Low — monitoring permissions exist but backend endpoints missing.

---

Bug 6: Inconsistent API Response Format (Array vs Object Wrapper)

Clusters and Registries return bare arrays:

[
    { "id": "...", "name": "k3s", ... }
]

Instances returns an object wrapper:

{
    "instances": [
        { "id": "...", "name": "test-nginx-b", ... }
    ],
    "total": 1
}

Expected: Consistent response format across all list endpoints. Either all return bare arrays or all use the { "items": [...], "total": N } wrapper pattern.

Severity: Low — API consistency issue. Makes client code harder to write generically.

---

Bug 7: auth/me Returns Empty Token Fields

Endpoint: GET /api/v1/auth/me Response includes empty/unpopulated fields:

{
    "accessToken": "",
    "refreshToken": "",
    ...
}

Expected: Either remove these fields from the /auth/me response (they are only meaningful in login/refresh responses) or populate them with valid values.

Actual: Emptry string values for both token fields create confusion about whether they should be present.

Severity: Low — cosmetic issue, but suggests the DTO is reusing the login response struct without clearing token fields.

---

Summary

#	Bug	Severity	Category
1	Tags endpoint 404	Medium	Missing Implementation
2	DELETE returns empty body	Medium	API Response Quality
3	Cluster stats endpoint 404	Low	Missing Implementation
4	Kubeconfig endpoint 404	Low	Missing Implementation
5	Monitoring metrics endpoint 404	Low	Missing Implementation
6	Inconsistent list response format	Low	API Consistency
7	auth/me returns empty tokens	Low	API Response Quality

Passed Tests:

• Login/authentication ✓
• Auth/me user info ✓
• Cluster listing ✓
• Cluster health check ✓
• Registry listing ✓
• Repository browsing (artifacts) ✓
• Instance deployment (nginx chart) ✓
• Instance status tracking (pending-install → deployed) ✓
• Instance deletion (async, transitions to pending-delete then removed) ✓
• Error handling for invalid repository ✓
• Error handling for missing required fields ✓
• Auth rejects invalid tokens ✓
• Auth rejects missing tokens ✓
• Instance cleanup confirmed ✓