Attachments bundles and flags not propagated on refresh?

[leplatrem]

Example on STAGE origins (not caching involved):

bundle is set on main-workspace (via permissions repo)

$ http "https://remote-settings.allizom.org/v1/buckets/main-workspace/collections/search-categorization/changeset?_expected=123456"  "Authorization: $BEARER" | jq .metadata.attachment
{
  "bundle": true,
  "enabled": true,
  "required": false
}

Latest signature was 6 days ago:

$ http "https://remote-settings.allizom.org/v1/buckets/main-workspace/collections/search-categorization/changeset?_expected=123456"  "Authorization: $BEARER" | jq .metadata.last_signature_date
"2024-08-21T00:00:13.640960+00:00"

And the flag was added on the workspace collection 3 weeks ago.

So the bundle flag should be present in the main-preview and main collections, but it's not:

$ http "https://remote-settings.allizom.org/v1/buckets/main-preview/collections/search-categorization/changeset?_expected=123456"  "Authorization: $BEARER" | jq .metadata.attachment
{
  "enabled": true,
  "required": false
}

$ http "https://remote-settings.allizom.org/v1/buckets/main/collections/search-categorization/changeset?_expected=123456"  "Authorization: $BEARER" | jq .metadata.attachment
{
  "enabled": true,
  "required": false
}

Using admin superpowers, let's trigger a signature refresh:

$ echo '{"data": {"status": "to-resign"}}' | http PATCH https://remote-settings.allizom.org/v1/buckets/main-workspace/collections/search-categorization --auth admin:$ADMINPASS_STAGE

The signature was refreshed as expected:

$ http "https://remote-settings.allizom.org/v1/buckets/main-workspace/collections/search-categorization/changeset?_expected=123456"  "Authorization: $BEARER" | jq .metadata.last_signature_date
"2024-08-27T18:19:07.910344+00:00"

But the bundle flag was not copied:

$ http "https://remote-settings.allizom.org/v1/buckets/main-preview/collections/search-categorization/changeset?_expected=123456789"  "Authorization: $BEARER" | jq .metadata.attachment
{
  "enabled": true,
  "required": false
}

$ http "https://remote-settings.allizom.org/v1/buckets/main/collections/search-categorization/changeset?_expected=123456789"  "Authorization: $BEARER" | jq .metadata.attachment
{
  "enabled": true,
  "required": false
}

This contradicts our unit tests:

remote-settings/kinto-remote-settings/tests/signer/test_updater.py

Lines 157 to 167 in f97cd84

	self.storage.update.assert_called_with(
	resource_name="collection",
	object_id="destcollection",
	parent_id="/buckets/destbucket",
	obj={
	"id": 1234,
	"signature": mock.sentinel.signature,
	"sort": "size",
	"displayFields": ["name"],
	},
	)

Related:

• Fix #1472: check attachments bundle mozilla-services/telescope#1473
• Always copy 'schema' and 'attachment' attributes to preview and final collections #633
• Improve build_bundles idempotence mozilla-services/remote-settings-lambdas#1488