prisma-risk / tsoracle / 26416857181

95%

Build Type

push

github

Committed by web-flow

Commit Message

fix(client): bound leader-hint redirects with an absolute cross-pass cap (#441)

The per-pass MAX_LEADER_REDIRECTS cap resets every re-poll pass, and a
cap hit is treated as an in-progress leadership transfer that rides out
across further passes. Since leader-hint redirects are not charged
against max_attempts (issue #340), the only whole-call ceiling on
attacker-directed outbound dials was overall_deadline. A peer that
returns a fresh, reachable hint on every dial could therefore churn far
more than MAX_LEADER_REDIRECTS connections in one issue_rpc call,
bounded only by the (operator-chosen) deadline.

Add a deadline-independent backstop: a persistent total_redirects
counter, capped at MAX_TOTAL_LEADER_REDIRECTS (MAX_LEADER_REDIRECTS * 4
= 64). Unlike the per-pass cap, hitting the absolute cap is terminal -
it surfaces a FAILED_PRECONDITION and stops rather than riding out. The
counter charges only actionable hint pivots, so a genuinely-electing
cluster (which signals via NoLeaderYet and consumes no redirect budget)
still rides out for the full deadline, and a real failover settles far
below the cap.

Closes #440

Coverage Stats

31 of 37 new or added lines in 1 file covered. (83.78%)

2 existing lines in 1 file now uncovered.

11161 of 11619 relevant lines covered (96.06%)

459246.46 hits per line