René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"AccountDaoImpl.findUserAccountByApiKey() generates random UUID instead of reading from database","articleBody":"### problem\nAPI key authentication returns random user UUID on every request.\n\nAccountDaoImpl.findUserAccountByApiKey() constructs a UserVO object using new UserVO(rs.getLong(1)), which generates a random UUID on every call instead of reading the user's actual UUID from the database. This causes misleading error messages where the user UUID changes on every request, making debugging and log correlation impossible.\n\nThe bug is visible when an API permission check fails (e.g., UnavailableCommandException), but the random UUID is also propagated to CallContext for all API-key-authenticated requests, potentially affecting audit trails and logging even for successful calls.\n\n### versions\n\nmain branch (also likely affects 4.19, 4.20 — the code has been this way for a long time)\nAPI, ACL (Dynamic Role-Based Access Checker)\n\n### The steps to reproduce the bug\n\nCreate a non-admin user with API keys\nEnsure the user's role does NOT have permission for a specific API (e.g., listGpuDevices)\nCall the API repeatedly using API key + signature authentication:\n\ncurl \"http://\u003cmgmt-server\u003e:8080/client/api?command=listGpuDevices\u0026apikey=\u003cKEY\u003e\u0026signature=\u003cSIG\u003e\"\ncurl \"http://\u003cmgmt-server\u003e:8080/client/api?command=listGpuDevices\u0026apikey=\u003cKEY\u003e\u0026signature=\u003cSIG\u003e\"\ncurl \"http://\u003cmgmt-server\u003e:8080/client/api?command=listGpuDevices\u0026apikey=\u003cKEY\u003e\u0026signature=\u003cSIG\u003e\"\nObserve the UUID in the error message changes with every request\nEXPECTED RESULTS\n\nThe user UUID in the error message should be the same on every request, matching the \nuser's actual UUID stored in the database:\n\n\"The API [listGpuDevices] does not exist or is not available for the account for user id [\u003cconsistent-uuid\u003e].\"\nACTUAL RESULTS\n\nEach request returns a different randomly generated UUID:\n\nRequest 1: \"The API [listGpuDevices] does not exist or is not available for the account for user id [976292f1-84d7-471d-8fa2-a77b6a4cc466].\"\nRequest 2: \"The API [listGpuDevices] does not exist or is not available for the account for user id [a3b1c2d4-5678-9012-abcd-ef3456789012].\"\nRequest 3: \"The API [listGpuDevices] does not exist or is not available for the account for user id [f1e2d3c4-b5a6-7890-1234-567890abcdef].\"\n\n### What to do about it?\n\nAccountDaoImpl.findUserAccountByApiKey() at engine/schema/src/main/java/com/cloud/user/dao/AccountDaoImpl.java:147 uses a raw SQL query and manually constructs a UserVO:\n\n\nUser u = new UserVO(rs.getLong(1));  // Constructor generates UUID.randomUUID()\nu.setUsername(rs.getString(2));\nu.setAccountId(rs.getLong(3));\nu.setSecretKey(DBEncryptionUtil.decrypt(rs.getString(4)));\nu.setState(State.getValueOf(rs.getString(5)));\nThe UserVO(long id) constructor at engine/schema/src/main/java/com/cloud/user/UserVO.java:125-128:\n\n\npublic UserVO(long id) {\n    this.id = id;\n    this.uuid = UUID.randomUUID().toString();  // Random UUID generated here!\n}\nThe SQL query (FIND_USER_ACCOUNT_BY_API_KEY) does not select the uuid column, and the code never calls u.setUuid() with the database value.\n\nFix: Add u.uuid to the SQL SELECT and call u.setUuid() when constructing the UserVO, or use the standard DAO findBy pattern instead of raw SQL.","author":{"url":"https://github.com/rybakovanton-metta","@type":"Person","name":"rybakovanton-metta"},"datePublished":"2026-02-09T12:00:47.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":4},"url":"https://github.com/12612/cloudstack/issues/12612"}