problem
When a user who holds the Project Admin role in a project is deleted, their row in the user table is marked as removed (soft delete), but the corresponding row in the project_account table is not cleaned up. The project membership record is left behind, still referencing a user that is now flagged as removed.
A subsequent code path that lists the project's accounts with the Project Admin role attempts to resolve that stale membership record. The lookup excludes removed users and returns null, which is then dereferenced, resulting in a NullPointerException.
Observed symptom
This is why the project listing fails for some users. Any user whose visible project set includes an affected project triggers the same code path, so the list projects call errors out rather than returning a partial result. Users with no affected project in scope are unaffected, which is why the failure appears to hit only some users.
Expected behaviour is for the project_account entry to be removed as part of user deletion, so no stale membership remains and the listing completes normally
versions
ACS 4.20.2.0
The steps to reproduce the bug
- Create two accounts and two users in each account in the same domain.
- Create a project as one account/user.
- Add the other user from step 1 to this project as Project Admin ( you may have to do this as ROOT admin in UI)
- As an 'admin' (ROOT admin) user delete the above user.
What to do about it?
This issue was originally logged for 4.19 and was fixed in 4.19.2 #9974
It seems that fix is lost when forward merge happened from 4.19 to 4.20
problem
When a user who holds the Project Admin role in a project is deleted, their row in the user table is marked as removed (soft delete), but the corresponding row in the project_account table is not cleaned up. The project membership record is left behind, still referencing a user that is now flagged as removed.
A subsequent code path that lists the project's accounts with the Project Admin role attempts to resolve that stale membership record. The lookup excludes removed users and returns null, which is then dereferenced, resulting in a NullPointerException.
Observed symptom
This is why the project listing fails for some users. Any user whose visible project set includes an affected project triggers the same code path, so the list projects call errors out rather than returning a partial result. Users with no affected project in scope are unaffected, which is why the failure appears to hit only some users.
Expected behaviour is for the project_account entry to be removed as part of user deletion, so no stale membership remains and the listing completes normally
versions
ACS 4.20.2.0
The steps to reproduce the bug
What to do about it?
This issue was originally logged for 4.19 and was fixed in 4.19.2 #9974
It seems that fix is lost when forward merge happened from 4.19 to 4.20