A wiki name whose site was never created can keep passing the certificate check until the console restarts #294
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: wiki-cafe/member-console#294
Reference in New Issue
Block a user
What happens
Some terms first. A placement is the domains registry's record that a name belongs to a site. The certificate check (
/domains/ask) asks the registry whether the proxy in front of the console may obtain a TLS certificate for a name, and answers yes for a placement marked servable.A FedWiki site create reserves its name with a placement that answers yes before the farm creates the site. When the farm call fails, the create releases that placement in compensation (
internal/integrations/fedwiki/workflows/requests.go:471; for a run that closed without an outcome,ReleaseCreateReservationActivity,internal/integrations/fedwiki/workflows/request_activities.go:548). When that release also fails after its retries, the workflow logs the failure and finishes the request as declined or failed. The placement is left with no site row and keeps answering yes.Only the orphan sweep at boot (
releaseOrphanedPlacements,internal/integrations/fedwiki/reconcile_domains.go:106) releases such a placement. On a console that runs for weeks, the name keeps getting certificates for a site nothing serves, and no other organization can claim the name until the next restart.What should happen
A placement whose create request has ended without a site stops answering yes when the request ends, or is released within one maintenance interval, without waiting for a restart.
Where
internal/integrations/fedwiki/workflows/requests.go(the create's compensation);internal/integrations/fedwiki/workflows/request_activities.go(ReleaseCreateReservationActivity);internal/integrations/fedwiki/reconcile_domains.go(releaseOrphanedPlacements);internal/integrations/fedwiki/store/queries/sites.sql(ListOrphanedPlacements).Why it matters
A database fault during a failed create leaves a name certified for a site that does not exist and unavailable to every other organization for as long as the console runs.