A FedWiki site's name can keep the wrong certificate answer after a status change #247

New Issue

2026-10-22T06:46:30Z

cgalo5758 commented

2026-10-22 06:46:30 +00:00

What happens

The certificate endpoint (/domains/ask) lets a site's name have a certificate when its placement is servable, and that flag is a second copy of the site row's status. An archive or a restore commits the row's status, then writes the flag in a separate transaction, best effort. If that write fails, or the worker stops between the two, the flag keeps its old value, and a retry finds the request finished and skips the write.

A swap writes no flag at all. Keep active refuses only a site that is already active, so a site archived after the page rendered (by the sync, for example) can be swapped in with its name still unservable.

Only the sync writes the flag again, from the row. The sync is off by default (fedwiki-sync-enabled), and boot leaves existing placements alone, so with the sync off a wrong flag stays. A restored site can be refused a certificate, and an archived one granted one.

What should happen

After any write of a site's status, its name is servable exactly when its row is active or read-only, whether the sync runs or not.

Where

internal/integrations/fedwiki/workflows/request_activities.go (RecordSiteStatusActivity), internal/integrations/fedwiki/workflows/activities.go, internal/integrations/fedwiki/workflows/swap.go (RecordSwapActivity), internal/integrations/fedwiki/workflows/sync.go, internal/integrations/fedwiki/reconcile_domains.go, internal/integrations/fedwiki/web/site_actions.go (KeepSiteActive)

Why it matters

A restored wiki can lose its certificate with nothing left that corrects the flag.

### What happens The certificate endpoint (`/domains/ask`) lets a site's name have a certificate when its placement is `servable`, and that flag is a second copy of the site row's status. An archive or a restore commits the row's status, then writes the flag in a separate transaction, best effort. If that write fails, or the worker stops between the two, the flag keeps its old value, and a retry finds the request finished and skips the write. A swap writes no flag at all. Keep active refuses only a site that is already active, so a site archived after the page rendered (by the sync, for example) can be swapped in with its name still unservable. Only the sync writes the flag again, from the row. The sync is off by default (`fedwiki-sync-enabled`), and boot leaves existing placements alone, so with the sync off a wrong flag stays. A restored site can be refused a certificate, and an archived one granted one. ### What should happen After any write of a site's status, its name is servable exactly when its row is active or read-only, whether the sync runs or not. ### Where `internal/integrations/fedwiki/workflows/request_activities.go` (`RecordSiteStatusActivity`), `internal/integrations/fedwiki/workflows/activities.go`, `internal/integrations/fedwiki/workflows/swap.go` (`RecordSwapActivity`), `internal/integrations/fedwiki/workflows/sync.go`, `internal/integrations/fedwiki/reconcile_domains.go`, `internal/integrations/fedwiki/web/site_actions.go` (`KeepSiteActive`) ### Why it matters A restored wiki can lose its certificate with nothing left that corrects the flag.

cgalo5758 added this to the Public launch milestone 2026-10-22 06:46:30 +00:00

cgalo5758 added the

kind

bug

area/domains area/fedwiki labels 2026-10-22 06:46:30 +00:00

cgalo5758 referenced this issue

2026-10-22 18:40:11 +00:00

FedWiki's site usage is a running total that many code paths adjust; derive it instead #165

Sign in to join this conversation.