main · last commit
1 month ago ·
2npkec0r
tarantool-etcd-v01 Auth never re-checked on a live Watch stream (expired token / auth revision bump ignored)
Lined Up
bd update tarantool-etcd-v01 --claim
bd close tarantool-etcd-v01
| Created by | Eugene Blikh |
| Owner | bigbes@gmail.com |
| Created | 2026-07-17T13:20:13Z |
| Updated | 2026-07-17T13:20:13Z |
etcd surfaces ErrInvalidAuthToken / ErrAuthOldRevision on a live stream when the token expires or the auth revision changes, cancelling affected watchers. We resolve the token once at stream open and ignore failure (app/etcd/grpc.lua:263-267); READ permission is checked only at watcher create (app/etcd/watch.lua:250-252). The stream then keeps delivering with the cached identity forever. Grep: ErrAuthOldRevision has no analogue anywhere in app/. Impact: revoking a user's permission or deleting the user does not stop an already-open watch from streaming their keys. Security-relevant, hence P1 rather than P2.
Re-validate the token per event batch and cancel watchers on increment_auth_revision. Needs a way to reach live watchers from the auth module — check whether the watcher registry (watch.lua:42-44) can be indexed by identity without adding contention on the hot delivery path.
Revoking a role mid-stream cancels the watch with the etcd-shaped error; token expiry surfaces on the stream; a test pins both.
No outgoing dependencies.
Nothing depends on this issue.
| id | tarantool-etcd-v01 |
| content_hash | c1e139e7df4222c2657166c19c9aa0a7382320d2dfd608fc98ced8da400afee2 |
| title | Auth never re-checked on a live Watch stream (expired token / auth revision bump ignored) |
| description | etcd surfaces ErrInvalidAuthToken / ErrAuthOldRevision on a live stream when the token expires or the auth revision changes, cancelling affected watchers. We resolve the token once at stream open and ignore failure (app/etcd/grpc.lua:263-267); READ permission is checked only at watcher create (app/etcd/watch.lua:250-252). The stream then keeps delivering with the cached identity forever. Grep: ErrAuthOldRevision has no analogue anywhere in app/. Impact: revoking a user's permission or deleting the user does not stop an already-open watch from streaming their keys. Security-relevant, hence P1 rather than P2. |
| design | Re-validate the token per event batch and cancel watchers on increment_auth_revision. Needs a way to reach live watchers from the auth module — check whether the watcher registry (watch.lua:42-44) can be indexed by identity without adding contention on the hot delivery path. |
| acceptance_criteria | Revoking a role mid-stream cancels the watch with the etcd-shaped error; token expiry surfaces on the stream; a test pins both. |
| notes | |
| status | open |
| priority | 1 |
| issue_type | bug |
| assignee | NULL |
| estimated_minutes | NULL |
| created_at | 2026-07-17T13:20:13Z |
| created_by | Eugene Blikh |
| owner | bigbes@gmail.com |
| updated_at | 2026-07-17T13:20:13Z |
| closed_at | NULL |
| closed_by_session | |
| external_ref | NULL |
| spec_id | |
| compaction_level | 0 |
| compacted_at | NULL |
| compacted_at_commit | NULL |
| original_size | NULL |
| sender | |
| ephemeral | 0 |
| wisp_type | |
| pinned | 0 |
| is_template | 0 |
| mol_type | |
| work_type | |
| source_system | |
| metadata | <binary> |
| source_repo | |
| close_reason | |
| event_kind | |
| actor | |
| target | |
| payload | |
| await_type | |
| await_id | |
| timeout_ns | 0 |
| waiters | |
| hook_bead | |
| role_bead | |
| agent_state | |
| last_activity | NULL |
| role_type | |
| rig | |
| due_at | NULL |
| defer_until | NULL |
| no_history | 0 |
| started_at | NULL |
| is_blocked | 0 |
| issue_id | tarantool-etcd-v01 |
| label | etcd-changelog-sweep |
| id | 019f703c-1417-7c5c-adac-cef1faee354d |
| issue_id | tarantool-etcd-v01 |
| event_type | created |
| actor | Eugene Blikh |
| old_value | |
| new_value | |
| comment | NULL |
| created_at | 2026-07-17T16:20:13Z |
| id | 019f703c-1418-75ef-a16b-4d56231b2a19 |
| issue_id | tarantool-etcd-v01 |
| event_type | label_added |
| actor | Eugene Blikh |
| old_value | NULL |
| new_value | NULL |
| comment | Added label: etcd-changelog-sweep |
| created_at | 2026-07-17T16:20:13Z |
No comments.