fix(backup): roll back a half-created config on upsert's create path (audit H6, L12) - #430
Merged
Merged
Conversation
`create` and `create_shared` both delete the config row they just inserted if the passphrase Secret can't be stored, with a comment stating the invariant: a failed Secret create must not leave a half-created config stuck in `provisioning` with no passphrase. `upsert`'s create path did the same insert and then created the Secret with a bare `?`. The resulting state is unrecoverable rather than merely wrong. The config persists with a `repo_password_ref` pointing at nothing, and because a config now exists, every retry takes the *update* path — which never creates a Secret — so the repo init job can never find the passphrase. The group stays stuck until an operator deletes and recreates it by hand. The in-memory secret store is what let this ship untested: `create_password` is create-if-absent (Kube answers 409) but the double silently overwrote and returned Ok, so no test could reach any caller's rollback. It now rejects, which is also a bug in its own right — a double-create passed in tests and 502'd in production. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SGfH1cdFKPnKpM7ytRThft
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes H6 (high) from the audit in #370, and L12 with it — see the note below on why they're one PR.
H6 — the missing rollback
createandcreate_sharedboth delete the config row they just inserted ifkube.create_passwordfails, with a comment stating the invariant: "a failed Secret create must not leave a half-created config stuck inprovisioningwith no passphrase."upsert's create path did the same insert and then created the Secret with a bare?.The resulting state is unrecoverable, not merely wrong. The config row persists with a
repo_password_refpointing at nothing — and because a config now exists, every subsequentupsertretry takes the update path, which never creates a Secret. The repo init job can never find the passphrase. IaC retries forever; the group stays stuck until an operator deletes and recreates it by hand.upsertnow mirrors its siblings: roll back the row, return the error.L12 — why it's in this PR
The audit notes H6 needs "a secret-store stub that fails once (the in-memory harness always succeeds)". That's L12:
create_passwordis documented and implemented as create-if-absent (Kube answers 409 →Upstream), but theMemoryvariant silently overwrote and returnedOk.That's a bug in its own right — a double-create path passes in tests and 502s in production — and it's also precisely what made H6 untestable. Fixing it is the enabling change, so splitting it into its own PR would leave the H6 fix unverified.
Memory::create_passwordnow rejects an existing secret, matching Kube.Tests
upsert_rolls_back_the_config_when_the_secret_cannot_be_created(private-server) — onboard a group so its Secret exists, drop only the config row (the state a prior interrupted onboarding leaves), thenupsert: the create path's Secret write fails, and the assertion is that no config row survives. Confirmed to fail against the unfixed handler.memory_create_password_rejects_an_existing_secret(commons-servers) — the double honours create-if-absent and doesn't clobber the existing value.The rest of the
/api/backups/*suite passes unchanged, so nothing was relying on the permissive double.Generated by Claude Code