Repository navigation
Hybrid: abandoned broker sign-ins expire after a day - #316
Merged
Merged
Conversation
The hosted broker finishes a provider sign-in in a holding partition and moves it to the install when the install redeems the code. A sign-in that is never redeemed left its server and token records behind for good. Server and token records in a holding partition (a team key with store::HOLDING_MARKER) now carry a ttl a day out on the MCP configs table, whose TTL attribute is already ttl; a team's own records never do.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Since #309, the hosted broker finishes a Notion, Confluence or Google Drive sign-in in a holding partition and moves it to the install only when the install redeems the code. Nothing removed a sign-in that was never redeemed, so its server and token records stayed for good. This PR has them expire after a day.
Changes
common/src/mcp_remote/store.rs:HOLDING_MARKER(#SIGNIN#),HOLDING_TTL_SECS(one day) andholding_expiry(team, now).ServerRecord::to_itemandTokenRecord::to_itemwritettlonly when the team key is a holding partition. Pending sign-ins already carried their own ten-minutettl. A team's own records never get one, and records moved into an install's partition are written without it.gateway/src/routes/hybrid.rs:signin_teambuilds its key fromHOLDING_MARKER, so the two can't drift apart.infra/lib/database-stack.ts: only the comment changes. The MCP configs table's TTL attribute is alreadyttl.Verification
holding_partitions_expire_and_nothing_else_does. It failed with thettlwrites removed and passes with them.a_provider_sign_in_is_held_apart_from_the_installnow also checks that the holding key expires and the install's own key doesn't.cargo fmt --check,cargo clippy --all-targets -- -D warnings,cargo test(workspace), infranpm test.