server: console user and role deletes leave the cached creation time

未关闭 适合新手
  • 哪里不对？
#787 0 条评论 0 个 reaction 已指派 1 人 在 GitHub 查看

维护者通常 4 天内回复

@LeeroyHannigan 已经在做这个了。

开始于 2026年11月5日。

  • #846 来自 @LeeroyHannigan —— 未关闭

评估

难度
2/5
预计耗时
1-3 小时
新手友好度
72/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
活跃
技术栈
rust
领域
authorization, security

调研方向

从 crates/server/src/console/pages/user_pages.rs 中的 delete_user（失效处理位于第 359-379 行附近）和 crates/server/src/console/pages/role_pages.rs 中的 delete_role（第 316-337 行）开始。将它们与 management/iam_user.rs:212 和 management/iam_role.rs:174 中的管理处理程序进行比较，后者分别调用 invalidate_user_created_at 和 invalidate_role_created_at。控制台处理程序应进行相同的调用。当在 TTL 内以相同名称重新创建的主体获得新的 aws:userid 时即完成，控制台删除路径的测试可以检查这一点。

由索引模型根据 Issue 内容生成。

描述

bug

The console's Delete user and Delete role handlers drop the deleted principal's cached credentials, policies, boundary and tags, but not its cached creation time. The management API handlers drop that too. A user or role that is deleted and then created again with the same name can therefore be evaluated with the old principal's creation time for up to auth.cache.ttl_seconds (60 s by default).

Mechanism

The creation time is an input to the principal's aws:userid (crates/auth/src/policy/principal_id.rs) and is read through the user_created_at and role_created_at caches (crates/server/src/authorization.rs:104, :206).

On main (2287d176):

  • management/iam_user.rs:212 calls invalidate_user_created_at, and management/iam_role.rs:174 calls invalidate_role_created_at, after the delete.
  • console/pages/user_pages.rs delete_user (invalidations at lines 359-379) and console/pages/role_pages.rs delete_role (lines 316-337) call every other invalidation but not these two.

So after a console delete, a same-name principal created within the TTL gets the deleted principal's aws:userid, and a policy condition on aws:userid written for the old principal matches the new one until the entry expires.

Reproduction

  1. Create user u with an access key, and make one request with it so the creation time is cached.
  2. Delete u in the console, create u again through the management API, and give it an access key.
  3. Within 60 s, make a request that is decided by an aws:userid condition. It is evaluated with the old user's id. After the TTL, or with the delete done through the management API, it uses the new id.

Expected

The console delete handlers drop the creation-time entry, as the management handlers do.

Found while writing #786.

主要语言
Rust
星标
517
派生
60
平均合并
5 天 4 小时
30 天内合并 PR
76

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

ExtendDB/extenddb 的其他 Issue

查看 ExtendDB/extenddb 的全部 Issue

相似的 Issue

更多 Rust Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。