From e37b513560504a04d93382cd322b1d34097f1b0a Mon Sep 17 00:00:00 2001
From: "Brian C. Lane" <bcl@redhat.com>
Date: Wed, 27 May 2020 15:37:42 -0700
Subject: [PATCH] weldr: Add check for deleting system sources

It was passing it through to the non-system delete function
and not returning an error. This checks for system repos first and
returns a 400, SystemSource error response if it is in the system list.
---
 internal/client/source_test.go |  4 ++--
 internal/weldr/api.go          | 26 ++++++++++++++++++++++----
 2 files changed, 24 insertions(+), 6 deletions(-)

diff --git a/internal/client/source_test.go b/internal/client/source_test.go
index e4c11e72b..8d26101ad 100644
--- a/internal/client/source_test.go
+++ b/internal/client/source_test.go
@@ -526,7 +526,7 @@ func TestDeleteSystemSourcesV0(t *testing.T) {
 		// try removing system source
 		resp, err := DeleteSourceV0(testState.socket, repo_name)
 		require.NoError(t, err, "DELETE source failed with a client error")
-		require.True(t, resp.Status, "DELETE source failed: %#v", resp)
+		require.False(t, resp.Status, "DELETE system source test failed: %#v", resp)
 
 		// verify that system sources are still there
 		list, api, err := ListSourcesV0(testState.socket)
@@ -552,7 +552,7 @@ func TestDeleteSystemSourcesV1(t *testing.T) {
 		// try removing system source
 		resp, err := DeleteSourceV1(testState.socket, repo_name)
 		require.NoError(t, err, "DELETE source failed with a client error")
-		require.True(t, resp.Status, "DELETE source failed: %#v", resp)
+		require.False(t, resp.Status, "DELETE system source test failed: %#v", resp)
 
 		// verify that system sources are still there
 		list, api, err := ListSourcesV1(testState.socket)
diff --git a/internal/weldr/api.go b/internal/weldr/api.go
index 640cfd96e..0ab5f9bb3 100644
--- a/internal/weldr/api.go
+++ b/internal/weldr/api.go
@@ -48,6 +48,15 @@ type API struct {
 	compatOutputDir string
 }
 
+// systemRepoIDs returns a list of the system repos
+// NOTE: The system repos have no concept of id vs. name so the id is returned
+func (api *API) systemRepoNames() (names []string) {
+	for _, repo := range api.repos {
+		names = append(names, repo.Name)
+	}
+	return names
+}
+
 var ValidBlueprintName = regexp.MustCompile(`^[a-zA-Z0-9._-]+$`)
 
 func New(rpmmd rpmmd.RPMMD, arch distro.Arch, distro distro.Distro, repos []rpmmd.RepoConfig, logger *log.Logger, store *store.Store, workers *worker.Server, compatOutputDir string) *API {
@@ -356,10 +365,7 @@ func (api *API) sourceListHandler(writer http.ResponseWriter, request *http.Requ
 	} else {
 		names = api.store.ListSourcesByName()
 	}
-
-	for _, repo := range api.repos {
-		names = append(names, repo.Name)
-	}
+	names = append(names, api.systemRepoNames()...)
 
 	err := json.NewEncoder(writer).Encode(reply{
 		Sources: names,
@@ -625,6 +631,18 @@ func (api *API) sourceDeleteHandler(writer http.ResponseWriter, request *http.Re
 		return
 	}
 
+	// Check for system repos and return an error
+	for _, id := range api.systemRepoNames() {
+		if id == name[0][1:] {
+			errors := responseError{
+				ID:  "SystemSource",
+				Msg: id + " is a system source, it cannot be deleted.",
+			}
+			statusResponseError(writer, http.StatusBadRequest, errors)
+			return
+		}
+	}
+
 	// Only delete the first name, which will have a / at the start because of the /*source route
 	if isRequestVersionAtLeast(params, 1) {
 		api.store.DeleteSourceByID(name[0][1:])