main · last commit
1 month ago ·
2npkec0r
tarantool-etcd-vab AuthStatus must not require prior authentication (etcd 3.7)
Lined Up
bd update tarantool-etcd-vab --claim
bd close tarantool-etcd-vab
| Created by | Eugene Blikh |
| Owner | bigbes@gmail.com |
| Created | 2026-07-17T11:30:22Z |
| Updated | 2026-07-17T11:30:22Z |
etcd 3.7: 'AuthStatus retrieval no longer requires prior authentication.' A client should be able to ask whether auth is enabled without already holding a token — which is the only sane ordering, since you need the answer to know whether to authenticate.
Our JSON gateway gates every method except 'authenticate' behind a valid bearer token (app/etcd/json.lua:662), and the gRPC path uses the same predicate shape, so POST /v3/auth/status with no token returns 16 (Unauthenticated) once auth is enabled. Upstream 3.7 answers it.
Fix: widen the exemption from a single method name to a small unauthenticated-method set containing 'authenticate' and 'status' (Auth.AuthStatus only — NOT Maintenance.Status, which routes to {'maintenance','status'} and shares the bare method name). Keep the gRPC and JSON gates driven by one predicate so they cannot drift.
Match on the (service, method) pair, not the bare method string — routes.lua has both {'auth','status'} and {'maintenance','status'}. Check upstream 3.7 whether Maintenance.Status is also unauthenticated before changing it; this issue only claims Auth.AuthStatus.
With auth enabled and no token: Auth.AuthStatus returns enabled=true + authRevision on both wires; every other method still returns Unauthenticated; a Lua test in test/auth_test.lua pins it.
No outgoing dependencies.
Nothing depends on this issue.
| id | tarantool-etcd-vab |
| content_hash | 80fa81f1f20e735f77e593b5e9975547a508502d5de68535ea41ac50091e1f7f |
| title | AuthStatus must not require prior authentication (etcd 3.7) |
| description | etcd 3.7: 'AuthStatus retrieval no longer requires prior authentication.' A client should be able to ask whether auth is enabled without already holding a token — which is the only sane ordering, since you need the answer to know whether to authenticate. Our JSON gateway gates every method except 'authenticate' behind a valid bearer token (app/etcd/json.lua:662), and the gRPC path uses the same predicate shape, so POST /v3/auth/status with no token returns 16 (Unauthenticated) once auth is enabled. Upstream 3.7 answers it. Fix: widen the exemption from a single method name to a small unauthenticated-method set containing 'authenticate' and 'status' (Auth.AuthStatus only — NOT Maintenance.Status, which routes to {'maintenance','status'} and shares the bare method name). Keep the gRPC and JSON gates driven by one predicate so they cannot drift. |
| design | Match on the (service, method) pair, not the bare method string — routes.lua has both {'auth','status'} and {'maintenance','status'}. Check upstream 3.7 whether Maintenance.Status is also unauthenticated before changing it; this issue only claims Auth.AuthStatus. |
| acceptance_criteria | With auth enabled and no token: Auth.AuthStatus returns enabled=true + authRevision on both wires; every other method still returns Unauthenticated; a Lua test in test/auth_test.lua pins it. |
| notes | |
| status | open |
| priority | 3 |
| issue_type | bug |
| assignee | NULL |
| estimated_minutes | NULL |
| created_at | 2026-07-17T11:30:22Z |
| created_by | Eugene Blikh |
| owner | bigbes@gmail.com |
| updated_at | 2026-07-17T11:30:22Z |
| closed_at | NULL |
| closed_by_session | |
| external_ref | NULL |
| spec_id | |
| compaction_level | 0 |
| compacted_at | NULL |
| compacted_at_commit | NULL |
| original_size | NULL |
| sender | |
| ephemeral | 0 |
| wisp_type | |
| pinned | 0 |
| is_template | 0 |
| mol_type | |
| work_type | |
| source_system | |
| metadata | <binary> |
| source_repo | |
| close_reason | |
| event_kind | |
| actor | |
| target | |
| payload | |
| await_type | |
| await_id | |
| timeout_ns | 0 |
| waiters | |
| hook_bead | |
| role_bead | |
| agent_state | |
| last_activity | NULL |
| role_type | |
| rig | |
| due_at | NULL |
| defer_until | NULL |
| no_history | 0 |
| started_at | NULL |
| is_blocked | 0 |
| id | 019f6fd7-8185-7046-8145-a8206c5d191a |
| issue_id | tarantool-etcd-vab |
| event_type | created |
| actor | Eugene Blikh |
| old_value | |
| new_value | |
| comment | NULL |
| created_at | 2026-07-17T14:30:22Z |
No comments.