Merge remote-tracking branch 'origin/main' into CBG-5198

Author: torcolvin

auth/auth.go

@@ -428,9 +428,17 @@ func (auth *Authenticator) Save(p Principal) error {
 	return nil
 }
 
-// Used for resync
-func (auth *Authenticator) UpdateSequenceNumber(p Principal, seq uint64) error {
+// Used for resync.  Cancels update if provided resyncID matches existing on the principal
+func (auth *Authenticator) UpdateSequenceNumberForResync(p Principal, seq uint64, resyncID string) error {
+
+	if resyncID == "" {
+		return errors.New("resyncID must not be empty")
+	}
+	if p.ResyncID() == resyncID {
+		return nil
+	}
 	p.SetSequence(seq)
+	p.SetResyncID(resyncID)
 	casOut, writeErr := auth.datastore.WriteCas(auth.LogCtx, p.DocID(), 0, p.Cas(), p, 0)
 	if writeErr != nil {
 		return writeErr

auth/auth_test.go

@@ -2959,6 +2959,228 @@ func TestInvalidateChannels(t *testing.T) {
 	}
 }
 
+// getRawPrincipal fetches the principal doc directly from the datastore, avoiding the channel
+// rebuild performed by GetUser/GetRole, so invalidation sequences can be inspected.
+func getRawPrincipal(t *testing.T, auth *Authenticator, name string, isUser bool) Principal {
+	ctx := base.TestCtx(t)
+	var princ Principal
+	var docID string
+	if isUser {
+		docID = auth.DocIDForUser(name)
+		princ = &userImpl{roleImpl: roleImpl{docID: docID}}
+	} else {
+		docID = auth.DocIDForRole(name)
+		princ = &roleImpl{docID: docID}
+	}
+	cas, err := auth.datastore.Get(ctx, docID, &princ)
+	require.NoError(t, err)
+	princ.SetCas(cas)
+	return princ
+}
+
+// createTestPrincipal creates and saves a user or role with a single explicit channel grant.
+func createTestPrincipal(t *testing.T, auth *Authenticator, name string, isUser bool) {
+	var princ Principal
+	var err error
+	if isUser {
+		princ, err = auth.NewUser(name, "password", ch.BaseSetOf(t, "ABC"))
+	} else {
+		princ, err = auth.NewRole(name, ch.BaseSetOf(t, "ABC"))
+	}
+	require.NoError(t, err)
+	require.NoError(t, auth.Save(princ))
+}
+
+// TestInvalidateChannelsIdempotent verifies that re-invalidating principals at the same or a
+// later sequence preserves the original invalidation sequence and does not write to the store.
+// It covers InvalidateDefaultChannels, InvalidateChannels, InvalidateRolesAndChannels, and
+// UpdateSequenceNumberForResync under a single test bucket.
+func TestInvalidateChannelsIdempotent(t *testing.T) {
+	const (
+		scopeName      = "scope1"
+		collectionName = "collection1"
+	)
+
+	ctx := base.TestCtx(t)
+	bucket := base.GetTestBucket(t)
+	defer bucket.Close(ctx)
+
+	collections := base.ScopeAndCollectionNames{
+		base.DefaultScopeAndCollectionName(),
+		base.NewScopeAndCollectionName(scopeName, collectionName),
+	}
+
+	t.Run("InvalidateDefaultChannels", func(t *testing.T) {
+		auth := NewTestAuthenticator(t, bucket.GetSingleDataStore(), nil, DefaultAuthenticatorOptions(ctx))
+
+		testCases := []struct {
+			name          string
+			principalName string
+			isUser        bool
+		}{
+			{name: "User", principalName: "idempotent_default_user", isUser: true},
+			{name: "Role", principalName: "idempotent_default_role", isUser: false},
+		}
+		for _, testCase := range testCases {
+			t.Run(testCase.name, func(t *testing.T) {
+				createTestPrincipal(t, auth, testCase.principalName, testCase.isUser)
+
+				require.NoError(t, auth.InvalidateDefaultChannels(testCase.principalName, testCase.isUser, 5))
+				princ := getRawPrincipal(t, auth, testCase.principalName, testCase.isUser)
+				require.Equal(t, uint64(5), princ.GetChannelInvalSeq())
+				casAfterFirst := princ.Cas()
+
+				// Re-invalidating at the same sequence must not write (CAS unchanged)
+				require.NoError(t, auth.InvalidateDefaultChannels(testCase.principalName, testCase.isUser, 5))
+				princ = getRawPrincipal(t, auth, testCase.principalName, testCase.isUser)
+				require.Equal(t, uint64(5), princ.GetChannelInvalSeq())
+				require.Equal(t, casAfterFirst, princ.Cas())
+
+				// Re-invalidating at a later sequence must keep the original invalidation sequence and not write
+				require.NoError(t, auth.InvalidateDefaultChannels(testCase.principalName, testCase.isUser, 20))
+				princ = getRawPrincipal(t, auth, testCase.principalName, testCase.isUser)
+				require.Equal(t, uint64(5), princ.GetChannelInvalSeq())
+				require.Equal(t, casAfterFirst, princ.Cas())
+			})
+		}
+	})
+
+	t.Run("InvalidateChannels", func(t *testing.T) {
+		options := DefaultAuthenticatorOptions(ctx)
+		options.Collections = map[string]map[string]struct{}{
+			base.DefaultScope: {base.DefaultCollection: struct{}{}},
+			scopeName:         {collectionName: struct{}{}},
+		}
+		auth := NewTestAuthenticator(t, bucket.GetSingleDataStore(), &mockComputer{}, options)
+
+		testCases := []struct {
+			name          string
+			principalName string
+			isUser        bool
+		}{
+			{name: "User", principalName: "idempotent_channels_user", isUser: true},
+			{name: "Role", principalName: "idempotent_channels_role", isUser: false},
+		}
+		for _, testCase := range testCases {
+			t.Run(testCase.name, func(t *testing.T) {
+				createTestPrincipal(t, auth, testCase.principalName, testCase.isUser)
+
+				// Invalidating more than one collection forces the update (non-subdoc) pathway
+				require.NoError(t, auth.InvalidateChannels(testCase.principalName, testCase.isUser, collections, 5))
+				princ := getRawPrincipal(t, auth, testCase.principalName, testCase.isUser)
+				require.Equal(t, uint64(5), princ.GetChannelInvalSeq())
+				require.Equal(t, uint64(5), princ.getCollectionChannelInvalSeq(scopeName, collectionName))
+				casAfterFirst := princ.Cas()
+
+				// Re-invalidating at the same sequence must not write (CAS unchanged)
+				require.NoError(t, auth.InvalidateChannels(testCase.principalName, testCase.isUser, collections, 5))
+				princ = getRawPrincipal(t, auth, testCase.principalName, testCase.isUser)
+				require.Equal(t, uint64(5), princ.GetChannelInvalSeq())
+				require.Equal(t, uint64(5), princ.getCollectionChannelInvalSeq(scopeName, collectionName))
+				require.Equal(t, casAfterFirst, princ.Cas())
+
+				// Re-invalidating at a later sequence must keep the original invalidation sequence and not write
+				require.NoError(t, auth.InvalidateChannels(testCase.principalName, testCase.isUser, collections, 20))
+				princ = getRawPrincipal(t, auth, testCase.principalName, testCase.isUser)
+				require.Equal(t, uint64(5), princ.GetChannelInvalSeq())
+				require.Equal(t, uint64(5), princ.getCollectionChannelInvalSeq(scopeName, collectionName))
+				require.Equal(t, casAfterFirst, princ.Cas())
+			})
+		}
+	})
+
+	t.Run("InvalidateRolesAndChannels", func(t *testing.T) {
+		computer := mockComputer{roles: ch.AtSequence(ch.BaseSetOf(t, "role1"), 1)}
+		options := DefaultAuthenticatorOptions(ctx)
+		options.Collections = map[string]map[string]struct{}{
+			base.DefaultScope: {base.DefaultCollection: struct{}{}},
+			scopeName:         {collectionName: struct{}{}},
+		}
+		auth := NewTestAuthenticator(t, bucket.GetSingleDataStore(), &computer, options)
+
+		t.Run("First invalidation sets sequence", func(t *testing.T) {
+			createTestPrincipal(t, auth, "invalidate_roles_channels_first", true)
+
+			require.NoError(t, auth.InvalidateRolesAndChannels("invalidate_roles_channels_first", collections, 5))
+			user := getRawPrincipal(t, auth, "invalidate_roles_channels_first", true).(*userImpl)
+			require.Equal(t, uint64(5), user.GetRoleInvalSeq())
+			require.Equal(t, uint64(5), user.GetChannelInvalSeq())
+			require.Equal(t, uint64(5), user.getCollectionChannelInvalSeq(scopeName, collectionName))
+		})
+
+		t.Run("Re-invalidation at later sequence preserves original", func(t *testing.T) {
+			createTestPrincipal(t, auth, "invalidate_roles_channels_reinvalidate", true)
+
+			require.NoError(t, auth.InvalidateRolesAndChannels("invalidate_roles_channels_reinvalidate", collections, 5))
+			casAfterFirst := getRawPrincipal(t, auth, "invalidate_roles_channels_reinvalidate", true).Cas()
+
+			require.NoError(t, auth.InvalidateRolesAndChannels("invalidate_roles_channels_reinvalidate", collections, 20))
+			user := getRawPrincipal(t, auth, "invalidate_roles_channels_reinvalidate", true).(*userImpl)
+			require.Equal(t, uint64(5), user.GetRoleInvalSeq())
+			require.Equal(t, uint64(5), user.GetChannelInvalSeq())
+			require.Equal(t, uint64(5), user.getCollectionChannelInvalSeq(scopeName, collectionName))
+			require.Equal(t, casAfterFirst, user.Cas())
+		})
+	})
+
+	t.Run("UpdateSequenceNumberForResync", func(t *testing.T) {
+		auth := NewTestAuthenticator(t, bucket.GetSingleDataStore(), nil, DefaultAuthenticatorOptions(ctx))
+
+		t.Run("Empty resyncID error", func(t *testing.T) {
+			user, err := auth.NewUser("resync_user_empty", "pass", nil)
+			require.NoError(t, err)
+			require.NoError(t, auth.Save(user))
+
+			err = auth.UpdateSequenceNumberForResync(user, 10, "")
+			assert.Error(t, err)
+			assert.Contains(t, err.Error(), "resyncID must not be empty")
+		})
+
+		t.Run("Matching resyncID (CAS should NOT update)", func(t *testing.T) {
+			user, err := auth.NewUser("resync_user_match", "pass", nil)
+			require.NoError(t, err)
+			require.NoError(t, auth.Save(user))
+
+			// First call with "resync-1" - updates CAS
+			require.NoError(t, auth.UpdateSequenceNumberForResync(user, 10, "resync-1"))
+
+			dbUser, err := auth.GetUser("resync_user_match")
+			require.NoError(t, err)
+			initialCas := dbUser.Cas()
+
+			// Second call with "resync-1" - should be skipped, CAS must not update
+			require.NoError(t, auth.UpdateSequenceNumberForResync(dbUser, 20, "resync-1"))
+
+			finalUser, err := auth.GetUser("resync_user_match")
+			require.NoError(t, err)
+			assert.Equal(t, initialCas, finalUser.Cas(), "CAS should not have changed")
+			assert.Equal(t, uint64(10), finalUser.Sequence(), "Sequence should remain unchanged")
+		})
+
+		t.Run("Mismatching resyncID (CAS should update)", func(t *testing.T) {
+			user, err := auth.NewUser("resync_user_mismatch", "pass", nil)
+			require.NoError(t, err)
+			require.NoError(t, auth.Save(user))
+
+			// First call with "resync-1"
+			require.NoError(t, auth.UpdateSequenceNumberForResync(user, 10, "resync-1"))
+
+			dbUser, err := auth.GetUser("resync_user_mismatch")
+			require.NoError(t, err)
+			casAfterFirst := dbUser.Cas()
+
+			// Second call with "resync-2" - mismatch, should update CAS
+			require.NoError(t, auth.UpdateSequenceNumberForResync(dbUser, 20, "resync-2"))
+
+			finalUser, err := auth.GetUser("resync_user_mismatch")
+			require.NoError(t, err)
+			assert.NotEqual(t, casAfterFirst, finalUser.Cas(), "CAS must be updated")
+			assert.Equal(t, uint64(20), finalUser.Sequence(), "Sequence should be updated to 20")
+			assert.Equal(t, "resync-2", finalUser.ResyncID(), "ResyncID should be updated to resync-2")
+		})
+	})
+}
+
 func TestCalculateMaxHistoryEntriesPerGrant(t *testing.T) {
 	testCases := []struct {
 		Name                     string

auth/principal.go

@@ -58,6 +58,12 @@ type Principal interface {
 	// Sets the created time for the principal document
 	SetCreatedAt(t time.Time)
 
+	// ResyncID returns a ID used to update sequence for a resync operation. If regenerate_sequences=false, this will be
+	// an empty string.
+	ResyncID() string
+	// SetResyncID sets the resync ID.
+	SetResyncID(resyncID string)
+
 	CompactChannelHistory(scope string, col string, channels []string) []string
 
 	// Principal includes the PrincipalCollectionAccess interface for operations against

auth/role.go

@@ -35,6 +35,7 @@ type roleImpl struct {
 	CollectionsAccess map[string]map[string]*CollectionAccess `json:"collection_access,omitempty"` // Nested maps of CollectionAccess, indexed by scope and collection name
 	UpdatedAt         time.Time                               `json:"updated_at"`
 	CreatedAt         time.Time                               `json:"created_at"`
+	ResyncID_         string                                  `json:"resync_id,omitempty"` // Last known ID for a resync operation. Used to ensure updating principals on multiple nodes is OK.
 	cas               uint64
 	docID             string // key used to store the roleImpl
 }
@@ -364,6 +365,18 @@ func (role *roleImpl) ChannelHistory() TimedSetHistory {
 	return role.ChannelHistory_
 }
 
+// ResyncID returns the last UUID of a resync operation that updated the sequence of this principal object. Otherwise,
+// returns empty string.
+func (role *roleImpl) ResyncID() string {
+	return role.ResyncID_
+}
+
+// SetResyncID sets an ID for the resync operation that updates this principal. Used to restrict updates for this object
+// to once per resync operation.
+func (role *roleImpl) SetResyncID(resyncID string) {
+	role.ResyncID_ = resyncID
+}
+
 // Checks whether this role object contains valid data; if not, returns an error.
 func (role *roleImpl) validate() error {
 	if !IsValidPrincipalName(role.Name_) {