Delete() doesn't work if Auth doesn't contain the ACL of the child path

[radu-munteanu]

Steps to reproduce:

1. Given a directory with world anyone ACL, create a child with one or more ACLs;
2. Try to delete the child path without any Auth set.

Expected result: Child should be deleted as the parent has world anyone ACL, and the permission for deletion is managed by the parent, not the child, as stated in docs: "DELETE: you can delete a child node"
Actual result: I get this error: zk: not authenticated

[radu-munteanu]

After further investigation, it seems that IF the child has at least one non-world ACL, the delete function requires the connection to have at least one added Auth, even though that Auth might be for an user which has only read rights, not admin. The Auth user credentials added must be from an existent ACL set for the child, otherwise you get the same error.

[radu-munteanu]

Tested further: I put an ACL for the parent, and give just that Auth to the session where I want to delete the child. It doesn't work. When I add one auth from the list of child's ACLs, it works.

[radu-munteanu]

I've tried a workaround, to create a "fake" user with no permissions, and use that ACL as auth. It doesn't work. So it must be an user with some rights, read works fine.

[samuel]

Are you able to reproduce this with zkCli or other client? This sounds like the server is rejecting the request rather than something controlled by the client.

[radu-munteanu]

No, that's the issue, with zkCli works as expected.

[radu-munteanu]

Any updates?

[radu-munteanu]

Any updates? 👍

[samuel]

Unfortunately, I don't have much time to look into this and haven't run into it myself. If you're able to pin down the specifics that would help a lot. One place to start would be to use the debug proxy (tracer) to dump out what zkCli is doing and compare it against this package to see the difference. go run tracer/main.go should do it. It listens on 127.0.0.1:2182 for client connections and expects a server listening on 127.0.0.1:2181