From e3bd3863cf830289da7a62ee4a6294fc6244c59f Mon Sep 17 00:00:00 2001
From: Filipe Constantinov Menezes <filipe.menezes@mongodb.com>
Date: Tue, 1 Sep 2026 16:58:43 +0100
Subject: [PATCH] CLOUDP-441133: fix service account teardown failing with 401

The CI job "Setup a Service Account and create a project" failed 100% of
the time at its final teardown step, blocking every unrelated PR.

generate-service-account.sh creates the service account against
$MONGODB_ATLAS_OPS_MANAGER_URL (cloud-dev), but
terminate-service-account.sh hardcoded https://cloud.mongodb.com/. The
account was created in cloud-dev and the delete attempted against prod,
where the configured API keys have no rights, so every run left an
orphaned ORG_OWNER service account behind.

Also fixed in the same area:

- Both scripts now use curl --fail-with-body, so a non-2xx response is a
  non-zero exit while the response body is still available for
  diagnostics. terminate-service-account.sh previously parsed the status
  out of the body with `jq -r '.error'`; on a successful 204 the body is
  empty, so the check became `[ "" -ge 300 ]`, which errored on stderr
  and then fell through to the success branch by accident. A failure
  returning a non-JSON body (e.g. an HTML 503) was reported as success.

- Masked the service account secret with ::add-mask:: so it is no longer
  echoed unredacted into this public repo's run logs. Unlike the API
  keys, this value is minted at runtime and passed between steps as an
  output, so GitHub does not mask it automatically.

- Added the missing MONGODB_ATLAS_OPS_MANAGER_URL guard to the terminate
  script, and corrected the generate script's guard, which reported
  MONGODB_ATLAS_ORG_ID as the missing variable.
---
 build/generate-service-account.sh  | 16 ++++++++++++----
 build/terminate-service-account.sh | 20 +++++++++++---------
 2 files changed, 23 insertions(+), 13 deletions(-)

diff --git a/build/generate-service-account.sh b/build/generate-service-account.sh
index a29d841..35a29d0 100755
--- a/build/generate-service-account.sh
+++ b/build/generate-service-account.sh
@@ -27,12 +27,13 @@ if [ -z "$MONGODB_ATLAS_ORG_ID" ]; then
   exit 1
 fi
 if [ -z "$MONGODB_ATLAS_OPS_MANAGER_URL" ]; then
-  echo "MONGODB_ATLAS_ORG_ID env var is not set"
+  echo "MONGODB_ATLAS_OPS_MANAGER_URL env var is not set"
   exit 1
 fi
 
-output=$(
-    curl --user "${MONGODB_ATLAS_PUBLIC_API_KEY}:${MONGODB_ATLAS_PRIVATE_API_KEY}" \
+if ! output=$(
+    curl --silent --show-error --fail-with-body \
+    --user "${MONGODB_ATLAS_PUBLIC_API_KEY}:${MONGODB_ATLAS_PRIVATE_API_KEY}" \
     --digest \
     --header "Accept: application/vnd.atlas.2025-03-12+json" \
     --header "Content-Type: application/json" \
@@ -45,10 +46,17 @@ output=$(
     ],
     "secretExpiresAfterHours": 8
     }'
-)
+); then
+  echo "Failed to create service account. Response:"
+  echo "$output"
+  exit 1
+fi
 
 client_id=$(echo "$output" | jq -r '.clientId')
 client_secret=$(echo "$output" | jq -r '.secrets[0].secret')
+if [ -n "$client_secret" ] && [ "$client_secret" != "null" ]; then
+  echo "::add-mask::$client_secret"
+fi
 
 if [ -z "$client_id" ] || [ "$client_id" = "null" ] || [ -z "$client_secret" ] || [ "$client_secret" = "null" ]; then
   echo "Failed to create service account. Response:"
diff --git a/build/terminate-service-account.sh b/build/terminate-service-account.sh
index 1f7ec74..fd74816 100644
--- a/build/terminate-service-account.sh
+++ b/build/terminate-service-account.sh
@@ -26,24 +26,26 @@ if [ -z "$MONGODB_ATLAS_ORG_ID" ]; then
   echo "MONGODB_ATLAS_ORG_ID env var is not set"
   exit 1
 fi
+if [ -z "$MONGODB_ATLAS_OPS_MANAGER_URL" ]; then
+  echo "MONGODB_ATLAS_OPS_MANAGER_URL env var is not set"
+  exit 1
+fi
 if [ -z "$CLIENT_ID" ]; then
   echo "CLIENT_ID env var is not set"
   exit 1
 fi
 
-output=$(
-    curl --user "${MONGODB_ATLAS_PUBLIC_API_KEY}:${MONGODB_ATLAS_PRIVATE_API_KEY}" \
+if ! output=$(
+    curl --silent --show-error --fail-with-body \
+    --user "${MONGODB_ATLAS_PUBLIC_API_KEY}:${MONGODB_ATLAS_PRIVATE_API_KEY}" \
     --digest \
     --header "Accept: application/vnd.atlas.2025-03-12+json" \
     --header "Content-Type: application/json" \
-    -X DELETE "https://cloud.mongodb.com/api/atlas/v2/orgs/${MONGODB_ATLAS_ORG_ID}/serviceAccounts/${CLIENT_ID}"
-)
-error_code=$(echo "$output" | jq -r '.error')
-
-if [ "$error_code" -ge 300 ]; then
+    -X DELETE "${MONGODB_ATLAS_OPS_MANAGER_URL}api/atlas/v2/orgs/${MONGODB_ATLAS_ORG_ID}/serviceAccounts/${CLIENT_ID}"
+); then
   echo "Failed to delete service account with Client ID $CLIENT_ID. Response:"
   echo "$output"
   exit 1
-else
-  echo "Service account with Client ID $CLIENT_ID has been deleted successfully."
 fi
+
+echo "Service account with Client ID $CLIENT_ID has been deleted successfully."