prisma-risk / tsoracle / 34876713984

97%

push

github

fix(server): guard the lease-set projection with the leader epoch (#707)

`persist_lease_mutation` projected the full live lease set from the in-memory table without checking the epoch, then handed it to `persist_leases`, which replaces the durable set wholesale. A step-down clears that table. A lease RPC that had already committed its window extension could then project from the cleared table and persist a set holding only its own record, dropping every other live lease from durable state. `lease_commit` refused afterwards, but the persist had already landed, the next fence seeded from it, and `GetSafeFrontier` could advance past a bound its holder was still stamping under.

The projection now takes the same check `lease_commit` uses, factored into `lease_table_at`: the epoch is compared under the lease-table lock, and the RPC answers NOT_LEADER when it has moved. A new `server::lease_flow::before_projection` yield point parks a lease mutation there so a test can step the node down and re-elect it mid-mutation. With the guard removed, that test loses the other holder's durable lease.

Signed-off-by: Sebastian Thiebaud <sebastian@prismarisk.com>

58 of 59 new or added lines in 2 files covered. (98.31%)

18403 of 19080 relevant lines covered (96.45%)

279486.09 hits per line