prisma-risk / tsoracle / 26416197751

95%

push

github

fix(server): enforce LeaderState::Follower driver contracts with a debug guard (#439)

LeaderState::Follower.leader_endpoint and leader_epoch carry two driver contracts that nothing enforced: the endpoint must be a scheme-less host:port (a TLS client silently drops http:// leader hints to refuse a transport downgrade, making a scheme-bearing leader unreachable via redirect) and the epoch must be per-node non-decreasing (the client's monotone-forward leader cache drops a hint that cannot outrank the cached leader). The shipped openraft/paxos drivers honor both by construction, so the contracts were a silent trap for a third-party driver.

Document both contracts on LeaderState::Follower and ConsensusDriver::leadership_events(), and add debug_assert_leader_state_contract in run_leader_watch, called once per observed event. The debug_assert!s compile out in release (zero production cost) and trip loudly in a driver author's own test suite.

Correct the scheme-bearing http:// leader_endpoint fixtures the guard surfaced (guarded-path tests plus the reference-example mapping unit tests a third-party author would copy). The TLS plaintext-hint-drop security test deliberately surfaces an http:// hint to verify the client refuses it; route that adversarial hint through a new wire-level fake peer (test_support::boot_fixed_hint_server_tls) instead of a real follower's leader-watch path, so the guard stays intact while the client-side assertion is preserved.

83 of 83 new or added lines in 4 files covered. (100.0%)

10675 of 11071 relevant lines covered (96.42%)

488893.02 hits per line