Can't remove deleted organizations from crate owners

[DianaNites]

Title. Also see similar? issue #1512, which the author closed.

The error is

error: failed to remove owners from crate

Caused by:
  api errors (status 404 Not Found): Not Found

A workaround exists, which is to recreate the organization and team, which lets you delete it.

But that may also be a potential security issue, what if someone else creates it and maliciously abuses their newly granted publish privileges? What about for organization renames?

[miraclx]

Any progress here?

[carols10cents]

If there was progress, it would be posted to the issue.

[carols10cents]

Over on #7042, @nic-hartley said:

Happy to put in a PR about this, it doesn't seem like it'd be a huge change. Though I'd need a pointer to. uh. where in this repo to start looking. it's quite large and intimidating.

All of the github related code is in https://github.com/rust-lang/crates.io/blob/main/src/github.rs; hopefully that's a useful starting place? I can provide more pointers later if needed.

The problem is that the current code is asking GitHub for existence of the org/team before removing it from the crate's owners, and the code should not need to check anything with GitHub in this case; it should just change the record in crate_owners for that team+crate to deleted='t'.

[nic-hartley]

@carols10cents I appreciate the pointer!

A quick fix does seem entirely doable to me (another variant or parameter for Team::create_or_update to disable the remote check and only look locally).

But as pointed out in the original post I do think this is a security issue, if only a minor one, so it might be better to build in some "does it still exist" check for crate owners, and delete GitHub organizations when they stop existing. Not sure how to build that, though, especially considering edge cases (what if the last owner of a crate gets deleted?)

I'll start a pull request (hopefully tonight! But I've got some boxes to carry.) with the quick fix, hopefully folks more experienced with the codebase have ideas for the autoremove. I don't think this issue occurs with normal users but I'll test it and make sure.