Plugins » Katello

Description:

After the fix introduced in #39309, deleting an organization that owns Content Credentials (of cert type) used by an Alternate Content Source (ACS) as CA cert, client cert, or client key fails with an ActiveRecord::DeleteRestrictionError.

Root cause:

#39309 changed the dependent: strategy on the three ACS associations of ContentCredential from :nullify to :restrict_with_exception. This correctly prevents standalone deletion of a
Content Credential while it is in use by an ACS. However, it also breaks organization deletion: when an organization is destroyed, Rails attempts to destroy its gpg_keys (Content
Credentials) before the ACS records have had their SSL cert references cleared. Since AlternateContentSource has no organization_id and is not directly owned by the organization, it is not destroyed as part of the cascade, and the restrict_with_exception fires.

Steps to reproduce:
1. Create a Content Credential of cert type.
2. Create an ACS using that credential as CA cert, client cert, or client key.
3. Attempt to delete the organization that owns the Content Credential.
4. The deletion fails with: Cannot delete record because of dependent ssl_ca_alternate_content_sources.

Expected behavior:
Deleting an organization destroys all its owned Content Credentials without error, nullifying any ACS SSL cert references in the process (since ACS is a global object not scoped to the organization).

Fix:
Add a before_destroy callback in OrganizationExtensions, placed before the has_many :gpg_keys, dependent: :destroy declaration, that nullifies ssl_ca_cert_id, ssl_client_cert_id, and ssl_client_key_id on any ACS records referencing the organization's Content Credentials. This preserves the protection against standalone CC deletion introduced in #39309 while allowing organization deletion to proceed cleanly.