Error CLI: can't become an admin

[iSLuP4l477u]

Hi, I recently self-hosted Ente and everything is working fine, but I'm encountering an issue while trying to increase storage. I followed the official server administration guide and created a museum.yaml file in the server directory alongside compose.yaml. I configured it as per the example, specifying the correct account ID I want to grant admin privileges to. Than I've installed and configured the latest version of the CLI for Windows. After rebuilding Docker with 'docker compose up --build -d', I added the account in the cli and attempted to increase its storage using the command:

update-subscription -a [email protected] -u [email protected]

However, I encountered the following error:

Error: status 401 with err: {"error":"insufficient permissions"}

The museum logs show:

[GIN-debug] redirecting request 301: /admin/user --> /admin/user?email=qf4nupls%40anonaddy.me
INFO[3893]request_logger.go:83 func3 incoming                                      client_ip=192.168.1.144 client_pkg=io.ente.photos client_version= query=email=qf4nupls%40anonaddy.me req_body= req_id=64f11c3f-a6b6-44ac-a07c-912f5fb6788f req_method=GET req_uri=/admin/user ua=go-resty/2.7.0 (https://github.com/go-resty/resty)
INFO[3893]request_logger.go:100 func3 outgoing                                      client_ip=192.168.1.144 client_pkg=io.ente.photos client_version= h_latency=631.196µs latency_time=631.196µs query=email=qf4nupls%40anonaddy.me req_body= req_id=64f11c3f-a6b6-44ac-a07c-912f5fb6788f req_method=GET req_uri=/admin/user status_code=401 ua=go-resty/2.7.0 (https://github.com/go-resty/resty) user_id=1580559962386438

I still don't seem to have admin privileges, but I'm pretty sure that the ID in the museum.yaml file is correct because I copied it from the one shown in the CLI using 'ente account list'.

[mnvr]

One possibility is that there is something amiss in the YAML config. Unfortunately, YAML has a lot of hidden traps and it is easy for things to look correct but not be what we intend. To rule this out, you could (for example) try and debug by printing the config that the running museum is seeing. For example, adding a log.Printf in this function to see what all IDs are being considered:

ente/server/pkg/middleware/auth.go

Line 81 in e390d73

if int64(admin) == userID {

[iSLuP4l477u]

I've added some logs and noticed that there are no admins:

[GIN-debug] redirecting request 301: /admin/user --> /admin/user?email=qf4nupls%40anonaddy.me
INFO[0615]request_logger.go:83 func3 incoming                                      client_ip=192.168.1.144 client_pkg=io.ente.photos client_version= query=email=qf4nupls%40anonaddy.me req_body= req_id=c07e561c-d2da-4d78-bffd-b977c9d1164f req_method=GET req_uri=/admin/user ua=go-resty/2.7.0 (https://github.com/go-resty/resty)
2024/06/23 09:57:29 Admin IDs from config: []
2024/06/23 09:57:29 User ID from request: 1580559962386438
INFO[0615]request_logger.go:100 func3 outgoing                                      client_ip=192.168.1.144 client_pkg=io.ente.photos client_version= h_latency=2.524297ms latency_time=2.524297ms query=email=qf4nupls%40anonaddy.me req_body= req_id=c07e561c-d2da-4d78-bffd-b977c9d1164f req_method=GET req_uri=/admin/user status_code=401 ua=go-resty/2.7.0 (https://github.com/go-resty/resty) user_id=1580559962386438

So probably there is something wrong in the YAML config right?

This is my museum.yaml config:

internal:
    admins:
        - 1580559962386438

[mnvr]

The yaml looks correct. So probably your custom museum.yaml just isn't being picked up. This is the code which reads it in, you can add debug logs here if it helps -

ente/server/pkg/utils/config/config.go

Line 50 in ead9ed0

err = mergeConfigFileIfExists("museum.yaml")

. My guess would be that it isn't getting mounted in your container.

[iSLuP4l477u]

I added some logs and they look good. Here are the logs I added:

func ConfigureViper(environment string) error {
        log.Printf("*********Configuring Viper for environment: %s\n", environment)
        // Ask Viper to read in values from the environment. These values will
		
		...
		
        if err != nil {
                return err
        }
        log.Printf("*******Viper configuration completed successfully for environment: %s\n", environment)

        return nil
}

func mergeConfigFileIfExists(configFile string) error {
        log.Printf("*******Attempting to merge config file: %s\n", configFile)
        configFileExists, err := doesFileExist(configFile)
        if err != nil {
                return err
        }
        if configFileExists {
                viper.SetConfigFile(configFile)
                log.Printf("*******Config file %s exists. Merging...\n", configFile)
                err = viper.MergeInConfig()
                if err != nil {
                        log.Printf("*******Error merging config file %s: %s\n", configFile, err)
                        return err
                }
        log.Printf("*******Config file %s merged successfully.\n", configFile)
        } else {
                log.Printf("*******Config file %s does not exist. Skipping...\n", configFile)
        }

        return nil
}

func doesFileExist(path string) (bool, error) {
        log.Printf("*******doesFileExist: %s\n", path)
        info, err := os.Stat(path)
		
		...
}

And here are the results:

2024/06/23 22:09:05 *********Configuring Viper for environment: local
2024/06/23 22:09:05 *******Attempting to merge config file: museum.yaml
2024/06/23 22:09:05 *******doesFileExist: museum.yaml
2024/06/23 22:09:05 *******Config file museum.yaml exists. Merging...
2024/06/23 22:09:05 *******Config file museum.yaml merged successfully.
2024/06/23 22:09:05 *******Attempting to merge config file: credentials.yaml
2024/06/23 22:09:05 *******doesFileExist: credentials.yaml
2024/06/23 22:09:05 *******Config file credentials.yaml exists. Merging...
2024/06/23 22:09:05 *******Config file credentials.yaml merged successfully.
2024/06/23 22:09:05 *******Viper configuration completed successfully for environment: local

It seems that it found the museum.yaml file and successfully merged it.

[iSLuP4l477u]

Right below that, there are some errors, but I don't think they are related:

2024/06/23 22:09:05 *******doesFileExist: data/billing/black-friday.json
ERRO[0000]offer.go:46 NewOfferController Error reading config fileopen : no such file or directory 
ERRO[0000]offer.go:50 NewOfferController Error un-marshalling JSONunexpected end of JSON input 
2024/06/23 22:09:05 *******doesFileExist: data/billing/in-testing.json
ERRO[0000]billing.go:91 parsePricingFile Error reading file : open : no such file or directory 
2024/06/23 22:09:05 *******doesFileExist: data/billing/us-testing.json
ERRO[0000]billing.go:91 parsePricingFile Error reading file : open : no such file or directory

[mnvr]

It seems that it found the museum.yaml file and successfully merged it.

But we don't know if it found your museum.yaml :) Let us try logging the entire file contents that it reads (or the file size, or something). Again, I'm not 100% sure what's going wrong, I'm just giving suggestions to help figure the issue out.

Right below that, there are some errors, but I don't think they are related:

Right, those are not related.

[iSLuP4l477u]

My credentials.yaml file doesn't have any internal section

db:
    host: postgres
    port: 5432
    name: ente_db
    user: pguser
    password: pgpass

s3:
    are_local_buckets: true
    b2-eu-cen:
        key: root_test1234!
        secret: password_test1234!
        endpoint: 192.168.1.92:9000
        region: eu-central-2
        bucket: ente
    wasabi-eu-central-2-v3:
        key: test
        secret: testtest
        endpoint: localhost:3200
        region: eu-central-2
        bucket: wasabi-eu-central-2-v3
        compliance: false
    scw-eu-fr-v3:
        key: test
        secret: testtest
        endpoint: localhost:3200
        region: eu-central-2
        bucket: scw-eu-fr-v3

[iSLuP4l477u]

I also tried to use the CLI from Linux, following your steps, in the "cli" folder of Ente (because I was using the CLI from Windows), but I encountered this error:

2024/06/24 22:46:43 error getting password from keyring: exec: "dbus-launch": executable file not found in $PATH

but I’m not sure it’s useful to try to use the cli from linux

[iSLuP4l477u]

Just for testing, I created another instance of Ente in another container but I encountered the same admin issue.

[mnvr]

So the gist seems to be that admin is present after reading the config

settings := viper.AllSettings()

But is lost when we try to get in with

admins := viper.GetIntSlice("internal.admins")

If you're up for debugging then you could try and find out where in the middle it is getting lost. Also might be a good idea to add a printf for admins := viper.GetIntSlice("internal.admins") at the same point where you're doing the test print from settings := viper.AllSettings().

---

All that's if you wish to debug. OTOH, if you just wish to unblock yourself, one easy way is to change:

if int64(admin) == userID { 

to

if YOUR_ID == userID { 

Another way is to directly modify the storage in the DB, something like this: https://help.ente.io/self-hosting/guides/external-s3#_4-create-an-account-and-increase-storage-quota

[mnvr]

We're also considering doing one more change soon – the first user that gets created will automatically get admin status – that will help in your case too.

[iSLuP4l477u]

Thank you for your help.
Maybe when I have some time, I'll try to see where the admin is lost, but for now, I think I'll simply change the if condition.