Skip to content

Fix unbounded subscription leak in auth ACL tracking #671

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
AlexGodbehere merged 1 commit into from
Jul 9, 2026
Merged

Fix unbounded subscription leak in auth ACL tracking #671

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 14 additions & 2 deletions acs-auth/lib/dataflow.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -200,13 +200,20 @@ export class DataFlow {
const principal$ = valid_uuid(input)
? rx.of(input)
: this.track_kerberos(input);
/* switchMap, not mergeMap: mergeMap keeps every inner
* subscription alive, so each re-emission of the principal
* (one per identity write, via the identities refetch) added
* another permanent subscription to acl_for. Long-lived
* notify sessions accumulated these without bound and every
* subsequent emission fanned out through all of them. */
return rxx.rx(
principal$,
rx.mergeMap(p => p ? this.acl_for(p) : rx.of([])),
rx.switchMap(p => p ? this.acl_for(p) : rx.of([])),
rx.map(acl => imm.Seq(acl)
.filter(e => e.permission == perm)
.map(e => e.target)
.toSet()),
rx.distinctUntilChanged(imm.is),
rx.tap(ptd =>
this.log("Permitted %s for %s: %o", perm, input, ptd.toJS())));
}
Expand Down Expand Up @@ -288,10 +295,15 @@ export class DataFlow {
}

track_kerberos (upn) {
/* The identities seq refetches the whole table on every
* identity write, so it re-emits equal content freely. Dedupe
* on the resolved UUID so downstream pipelines only see a
* change when the mapping actually changes. */
return rxx.rx(
this.identities,
rx.map(ids => ids.filter(i => i.kind == "kerberos" && i.name == upn)),
rx.map(acc => acc[0]?.uuid));
rx.map(acc => acc[0]?.uuid),
rx.distinctUntilChanged());
}

find_kerberos (upn) {
Expand Down
Loading