Listing namespaces causes exception, if none are present

[mdegel]

When listing namespaces the API throws an exception if no namespaces are found.

Example Code:

try:
    ns_client = hvac.Client(url="https://vault.company.org", namespace="some_namespace", token="some_token")
    sub_namespaces = ns_client.sys.list_namespaces()
except Exception as e:
    import traceback
    logging.error(f"Err: {e}")
    print(traceback.format_exc())

yields:

2022-12-20 14:17:18,461 - DEBUG - https://vault.company.org:443 "LIST /v1/sys/namespaces HTTP/1.1" 404 14
2022-12-20 14:17:18,462 - ERROR - Err: None, on list https://vault.company.org/v1/sys/namespaces
Traceback (most recent call last):
  File "C:\Path\to\Project\sync_vault_config.py", line 56, in get_namespaces
    sub_namespaces = ns_client.sys.list_namespaces()
  File "C:\Path\to\Project\venv\lib\site-packages\hvac\api\system_backend\namespace.py", line 30, in list_namespaces
    return self._adapter.list(
  File "C:\Path\to\Project\venv\lib\site-packages\hvac\adapters.py", line 164, in list
    return self.request("list", url, **kwargs)
  File "C:\Path\to\Project\venv\lib\site-packages\hvac\adapters.py", line 356, in request
    response = super().request(*args, **kwargs)
  File "C:\Path\to\Project\venv\lib\site-packages\hvac\adapters.py", line 322, in request
    utils.raise_for_error(
  File "C:\Path\to\Project\venv\lib\site-packages\hvac\utils.py", line 42, in raise_for_error
    raise exceptions.InvalidPath(message, errors=errors, method=method, url=url)
hvac.exceptions.InvalidPath: None, on list https://vault.company.org/v1/sys/namespaces

The API works as intended as long as namespaces are found, the error only occurs when the API yields a 404.
When looking into the Vault CLI / UI they simply show an empty list / nothing.

Maybe hvac could return either None or [] in case of non-existing namespaces?

[briantist]

Thanks for raising this @mdegel !

I'm considering whether we need to change this at a more central level than just for listing namespaces. It seems that this is standard behavior for any LIST operation in Vault that would have returned an empty list:

• List should return 404 hashicorp/vault#1365
• In a list response, if there are no keys, 404 to be consistent with GET hashicorp/vault#1368

This might be something we consider changing centrally, but it would be a breaking change for all LIST operations, and so I would also like to consider how we might provide opt-in / opt-out.

---

In the meantime, you can handle this from your own code like so:

import hvac
ns_client = hvac.Client(url="https://vault.company.org", namespace="some_namespace", token="some_token")

try:
    sub_namespaces = ns_client.sys.list_namespaces()
except hvac.exceptions.InvalidPath:
    sub_namespaces = []