feat: repair multiple permissions docs for a shared drive on documents get(permissions check)

Author: shepilov

model/permission/permissions.go

@@ -281,7 +281,14 @@ func getShareInteractPermissions(db prefixer.Prefixer, sharingID string) ([]Perm
 	}
 	err := couchdb.FindDocs(db, consts.Permissions, &req, &res)
 	if err != nil {
-		return nil, err
+		// With a cluster of couchdb, we can have a race condition where we
+		// query an index before it has been updated for a doc that has just
+		// been created. Keep the same fallback as getFromSource.
+		time.Sleep(1 * time.Second)
+		err = couchdb.FindDocs(db, consts.Permissions, &req, &res)
+		if err != nil {
+			return nil, err
+		}
 	}
 	return res, nil
 }
@@ -335,7 +342,11 @@ func shareInteractRepairState(perms []Permission, sharingID string) (*Permission
 	canonicalID := ShareInteractPermissionID(sharingID)
 	var canonical *Permission
 	usable := 0
+	hasDuplicate := false
 	for i := range perms {
+		if perms[i].ID() != canonicalID {
+			hasDuplicate = true
+		}
 		if perms[i].Expired() {
 			continue
 		}
@@ -347,7 +358,7 @@ func shareInteractRepairState(perms []Permission, sharingID string) (*Permission
 	if usable == 0 {
 		return nil, false, ErrExpiredToken
 	}
-	if usable == 1 && canonical != nil {
+	if usable == 1 && canonical != nil && !hasDuplicate {
 		return canonical, false, nil
 	}
 	return nil, true, nil
@@ -370,15 +381,14 @@ func repairShareInteractPermissions(db prefixer.Prefixer, sharingID string, perm
 			hasCanonical = true
 			// If the canonical doc is expired, update that doc ID but rebuild its content from non-expired docs.
 			merged.SetRev(p.Rev())
+		} else {
+			duplicates = append(duplicates, p)
 		}
 		if p.Expired() {
 			continue
 		}
 
 		hasUsablePermission = true
-		if p.ID() != canonicalID {
-			duplicates = append(duplicates, p)
-		}
 
 		if len(merged.Permissions) == 0 && len(p.Permissions) > 0 {
 			merged.Permissions = p.Clone().(*Permission).Permissions

model/permission/permissions_test.go

@@ -494,6 +494,57 @@ func TestGetForShareInteractRepairsDuplicateDocs(t *testing.T) {
 	require.Len(t, all, 1)
 }
 
+func TestGetForShareInteractRepairsExpiredDuplicateDocs(t *testing.T) {
+	if testing.Short() {
+		t.Skip("an instance is required for this test: test skipped due to the use of --short flag")
+	}
+
+	config.UseTestFile(t)
+	require.NoError(t, couchdb.ResetDB(testPrefix, consts.Permissions))
+
+	const sharingID = "sharing-expired-duplicate-interact-permissions"
+	rules := Set{{
+		Title:  "Shared drive",
+		Type:   consts.Files,
+		Values: []string{"shared-drive-root"},
+		Verbs:  ALL,
+	}}
+	expiredAt := time.Now().Add(-time.Hour).Format(time.RFC3339)
+
+	err := couchdb.CreateNamedDoc(testPrefix, &Permission{
+		PID:         ShareInteractPermissionID(sharingID),
+		Type:        TypeShareInteract,
+		Permissions: rules,
+		Codes: map[string]string{
+			"alice@example.test": "alice-token",
+		},
+		SourceID: consts.Sharings + "/" + sharingID,
+	})
+	require.NoError(t, err)
+	err = couchdb.CreateDoc(testPrefix, &Permission{
+		Type:        TypeShareInteract,
+		Permissions: rules,
+		Codes: map[string]string{
+			"expired@example.test": "expired-token",
+		},
+		ExpiresAt: expiredAt,
+		SourceID:  consts.Sharings + "/" + sharingID,
+	})
+	require.NoError(t, err)
+
+	repaired, err := GetForShareInteract(testPrefix, sharingID)
+	require.NoError(t, err)
+	require.Equal(t, ShareInteractPermissionID(sharingID), repaired.ID())
+	require.Equal(t, map[string]string{
+		"alice@example.test": "alice-token",
+	}, repaired.Codes)
+
+	all, err := getShareInteractPermissions(testPrefix, sharingID)
+	require.NoError(t, err)
+	require.Len(t, all, 1)
+	require.Equal(t, ShareInteractPermissionID(sharingID), all[0].ID())
+}
+
 func TestCreateShareInteractSetUsesCanonicalDoc(t *testing.T) {
 	if testing.Short() {
 		t.Skip("an instance is required for this test: test skipped due to the use of --short flag")