Sign in

Search issue titles and bodies, change requests and comments. Private repositories you cannot read are not included.
vole
Clone

Read only, no credentials:

https://rodent.software/git/vole.git

Write over SSH with a registered key:

git clone ssh://git@0.0.0.0:2222/vole.git

A free and open-source forge that lives in your Git repo.

#10

P1: Fix ACL races and approval/runner authorization durability

closed · opened by keenan 13d ago

keenan opened this 13d ago

Why

server/web/settings.go:113 (SaveSettings) loads the ACL, then writes the whole ACL object back when visibility changes. forge/access/store.go:89 (Set) has no compare-and-swap or version check.

A repository admin can race an instance admin’s role removal: the repo admin’s stale save can restore their old ACL entry.

Also:

  • metadata.FindApprovedMatch and the run page count approval files without checking that the approver is still active and currently a maintainer/admin.
  • ACL.CanReport accepts any name in the runners list, including retired/demoted accounts.

Scope

  • Add optimistic concurrency to access.Store.
  • Make SaveSettings update only the fields it owns; never rewrite entries/runners/approval policy.
  • Make SaveRepositoryAccess and AddRepositoryAccess use the same CAS path.
  • At merge time, count only approvals from currently active accounts holding maintain or admin.
  • Wire an active-account/current-role predicate into ACL.CanReport.
  • Add a race test: settings save vs role removal; the removal must win.

Acceptance

  • A repo admin cannot restore a revoked role by racing settings.
  • Demoted or retired approvers and runners no longer satisfy gates.

Comments (0)

No comments yet.