prisma-risk / tsoracle / 26380772761

95%

Build Type

push

github

Committed by web-flow

Commit Message

fix(client): bound leader-hint redirect chains with an absolute cap (#386)

Leader-hint redirects are deliberately not charged against `max_attempts`
(issue #340) so a legitimate failover chain can outlast the failure
budget. That left `overall_deadline` as the only ceiling on redirect
count: a malicious or persistently flapping peer that returns a fresh,
never-visited leader hint on every dial could drive the client through an
unbounded redirect chain — one outbound connection per hop — for the whole
deadline, weakening an availability guard.

Add `MAX_LEADER_REDIRECTS` (16), an absolute backstop on actionable
leader-hint pivots independent of `overall_deadline`. The cap sits far
above any real failover: legitimate hints point at a finite cluster and
dedup via the worklist visited-set, so a healthy chain is bounded by the
node count long before this bites, and only a pathological chain reaches
it. On hitting the cap the loop surfaces the redirect FAILED_PRECONDITION
rather than the misleading NoReachableEndpoints the worklist would
otherwise yield, and increments a new
tsoracle.client.leader_redirect_cap.total metric.

Only LeaderHint grows the worklist (StaleLeaderHint/HintRejected consume
existing entries; Err is already charged), so a single pivot counter
bounds the whole loop without disturbing the other arms.

Coverage Stats

115 of 123 new or added lines in 1 file covered. (93.5%)

3 existing lines in 2 files now uncovered.

12582 of 13267 relevant lines covered (94.84%)

398035.65 hits per line