Stale credential re-save can overwrite newer writes
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 5/5
- 预计耗时
- 一周以上
- 新手友好度
- 35/100
- Issue 类型
- 缺陷
- 描述清晰度
- 基本清楚
- 活跃度
- 活跃
- 技术栈
- typescript
调研方向
Start by reading the stale credential re-save added in #3109 and the listed writers in handlers/oauth-callback.ts, chat/credentials/unlink-provider.ts, chat/mcp/service-account.ts, and chat/credentials/service-account.ts. The issue says the state adapter has no compare-and-set, so investigate the adapter and how these writes can avoid restoring an older value or a disconnected credential. Done means reconnects and disconnects cannot be overwritten by a stale re-save; the issue names no tests.
由索引模型根据 Issue 内容生成。
描述
When Junior reads a stale credential, it saves it again with the active key. A credential is stale if it was saved before encryption or with a key that is no longer active. This was added in #3109. The re-save takes the refresh lock (user tokens) or the update lock (MCP service accounts), reads the value again, and writes it. Some writers change the same key without that lock:
- OAuth reconnect:
userTokenStore.setinhandlers/oauth-callback.ts - Disconnect:
userTokenStore.deleteinchat/credentials/unlink-provider.ts - MCP service-account sign-in (
putMcpServiceAccountCredentialsinchat/mcp/service-account.ts) and disconnect (chat/credentials/service-account.ts)
If one of those writes lands between the re-save's read and its write:
- a reconnect gets overwritten by the old token, or
- a disconnected credential comes back.
The window is milliseconds. It is most likely right after the deploy of #3109, because every plaintext token is stale and gets re-saved on its first read. The lock cannot close the window, because the state adapter has no compare-and-set.
We accepted this for #3109 and are tracking it here.
via @dcramer.
--
- 主要语言
- TypeScript
- 星标
- 397
- 派生
- 43
- 平均合并
- 8 小时 28 分钟
- 30 天内合并 PR
- 764
环境准备
- 提供 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
getsentry/junior 的其他 Issue
-
难度 2/5 1-3 小时 新手友好度 78/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 64/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 72/100
维护者通常 1 天内回复
-
难度 5/5 一周以上 新手友好度 25/100
维护者通常 1 天内回复
-
难度 5/5 一周以上 新手友好度 35/100
维护者通常 1 天内回复
相似的 Issue
-
难度 1/5 1-3 小时 新手友好度 86/100
g1331/phantom-circuit#93 ·
维护者通常 1 天内回复
-
bug
难度 2/5 1-3 小时 新手友好度 68/100
-
难度 2/5 1-3 小时 新手友好度 78/100
维护者通常 1 天内回复
-
compiler
难度 2/5 1-3 小时 新手友好度 74/100
HerringtonDarkholme/hd-lang#1699 ·
维护者通常 1 天内回复
-
account bug communication lecture
难度 2/5 1-3 小时 新手友好度 78/100
维护者通常 1 天内回复