CBG-4345 don't panic if role documents can't be read

[torcolvin]

CBG-4345 don't panic if role documents can't be read

If a role can't be read, we want to end the connection because we don't know the right role information to use to use. In the case of BLIP, we should exit with a 503 to indicate to the app to retry. At the point we have a auth.User object, we have authenticated and that's probably OK, but there could be an error reading the role document (SDK error, etc).

I changed the handler code to exit with the auth error if we can't read the role document from the user. This is a behavioral change, but I think is the correct one to do, we don't know information about the user. An alternative would be to log an info or error. This is not that dissimilar to the behavior we have now (GetRole would panic, the HTTP handler would exit 500).

This code will need careful review to make sure that the functions and goroutines will terminate correctly.

Pre-review checklist

• Removed debug logging (fmt.Print, log.Print, ...)
• Logging sensitive data? Make sure it's tagged (e.g. base.UD(docID), base.MD(dbName))
• Updated relevant information in the API specifications (such as endpoint descriptions, schemas, ...) in docs/api

Integration Tests

• GSI=true,xattrs=true https://jenkins.sgwdev.com/job/SyncGatewayIntegration/148/

[Copilot]

Pull Request Overview

This PR addresses panic issues when role documents cannot be read by converting functions that previously panicked into error-returning functions. The changes ensure graceful error handling throughout the authentication and channel access system, particularly when role documents are missing or corrupted.

Key changes:

• Modified authentication functions to return errors instead of panicking when role documents can't be read
• Updated all callers to handle the new error returns
• Added proper error logging and user-friendly error responses

Reviewed Changes

Copilot reviewed 22 out of 22 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
auth/principal.go	Updated interface definitions to return errors for channel access methods
auth/user.go	Modified user methods to return errors when role loading fails instead of panicking
auth/role.go	Updated role methods to return errors for channel access operations
auth/user_collection_access.go	Added error handling to collection-specific channel access methods
auth/role_collection_access.go	Updated collection role methods to return errors
auth/collection_access.go	Modified interface definitions for collection access to include error returns
db/crud.go	Updated MakeUserCtx to handle errors from user channel operations
db/changes.go	Added error handling throughout changes feed processing
db/design_doc.go	Updated view filtering to handle channel access errors
db/functions/function.go	Added error handling for channel authorization in functions
db/functions/js_function.go	Updated JavaScript function execution to handle user context errors
rest/handler.go	Modified audit logging to handle role retrieval errors gracefully
rest/bulk_api.go	Updated bulk operations to handle channel access errors properly
rest/admin_api.go	Added error handling to principal marshaling
rest/diagnostic_api.go	Updated diagnostic API to handle channel access errors
rest/user_api_test.go	Updated tests to handle new error returns
rest/role_api_test.go	Modified tests to check for errors in channel operations
db/util_testing.go	Added error handling to test utilities
db/database_test.go	Updated tests to handle new error signatures
auth/user_test.go	Modified tests to check for errors in user operations
auth/auth_test.go	Updated authentication tests to handle new error returns
auth/collection_access_test.go	Added error checking to collection access tests

[Copilot]

Pull Request Overview

Copilot reviewed 24 out of 24 changed files in this pull request and generated 2 comments.

[adamcfraser]

Looks fine. Generally I don't like including the text "Error" in warning or info logging, made a few suggestions to avoid that, and a few other error handling comments.