stacklok / toolhive / 34387984340

71%

Build Type

push

github

Committed by web-flow

Commit Message

Guard rotating refresh-token writes with compare-and-swap (#6548)

* Guard refresh-token writes with compare-and-swap

Two Connector Gateway replicas sharing the same Redis-backed
UpstreamTokenStorage can redeem and persist the same single-use,
rotating refresh token concurrently. The in-process singleflight
group only deduplicates refreshes within one process, and
StoreUpstreamTokens is an unconditional overwrite, so the losing
replica's write can silently clobber the winner's already-rotated
token and dead-end the refresh chain.

Add UpstreamTokenStorage.CompareAndSwapUpstreamTokens, conditioned on
the refresh token currently stored matching the value the caller just
redeemed with. The refresher now writes through it instead of
StoreUpstreamTokens: a losing write fails with ErrConcurrentRefresh
instead of overwriting, and the refresher re-reads the row to hand
back the winning replica's tokens (or a clear error if no usable
winner exists) rather than retrying an already-dead redemption.

* Address review: dedupe CAS script, richer errors, more tests

- Unify storeUpstreamTokensScript and casUpstreamTokensScript's
  write/index Lua body into one shared constant instead of a
  hand-duplicated copy, so the two scripts cannot silently drift.
- Include the re-read error in resolveConcurrentRefreshConflict's log
  and returned error instead of discarding it.
- Fix a stale comment still naming StoreUpstreamTokens on a path that
  now writes through CompareAndSwapUpstreamTokens.
- Add a timeout guard to the concurrent Redis CAS test's WaitGroup,
  matching this file's existing pattern.
- Add coverage: empty-expected-value CAS against an already-populated
  row (both backends), the "re-read succeeds but still expired"
  conflict-resolution branch, and session-index/TTL/user-reverse-index
  assertions on a successful Redis CAS write.
- Update docs/arch/11-auth-server-storage.md's "Refresh Coordination
  Scope" section, which stated no cross-process CAS guaran... (continued)

Coverage Stats

108 of 120 new or added lines in 4 files covered. (90.0%)

16 existing lines in 6 files now uncovered.

80244 of 113987 relevant lines covered (70.4%)

93.3 hits per line