Investigate competing recovery-key enrollment test failure #274

Closed
opened 2026-09-27 21:34:39 +00:00 by kayg · 1 comment
Owner

Evidence

The one-time workspace Rust test command on 2026-09-27 was:

cargo test --quiet

It exited 101 in the calternal-auth library. The test key_rotation_revokes_sessions_and_rejects_competing_recovery failed at store.rs:2676: it expected one successful enrollment, but both concurrent results were errors (left 0, right 1).

The test uses an in-memory SQLite pool with one connection. It races two enroll_recovery_key calls using the same old recovery phrase, then expects one winner and one rejected competing attempt. The assertion only counts successes, so this run did not reveal either error value. No other test binaries ran after the failing library target.

Follow-up

Please capture the two error variants and determine why both operations failed. Preserve the security invariant that exactly one recovery key is rotated, the other attempt is rejected, and active sessions are revoked only by the successful rotation. This job did not rerun the test.

## Evidence The one-time workspace Rust test command on 2026-09-27 was: cargo test --quiet It exited 101 in the calternal-auth library. The test key_rotation_revokes_sessions_and_rejects_competing_recovery failed at store.rs:2676: it expected one successful enrollment, but both concurrent results were errors (left 0, right 1). The test uses an in-memory SQLite pool with one connection. It races two enroll_recovery_key calls using the same old recovery phrase, then expects one winner and one rejected competing attempt. The assertion only counts successes, so this run did not reveal either error value. No other test binaries ran after the failing library target. ## Follow-up Please capture the two error variants and determine why both operations failed. Preserve the security invariant that exactly one recovery key is rotated, the other attempt is rejected, and active sessions are revoked only by the successful rotation. This job did not rerun the test.
Author
Owner

Superseded by #275, merged in 976b804f9 on origin/dev. crates/calternal-auth/src/store.rs now has a file-backed WAL concurrency regression for key_rotation_revokes_sessions_and_rejects_competing_recovery; it asserts one success, InvalidToken for the competing attempt, and session revocation. The #275 report records 500 consecutive passes.

Superseded by #275, merged in 976b804f9 on origin/dev. crates/calternal-auth/src/store.rs now has a file-backed WAL concurrency regression for key_rotation_revokes_sessions_and_rejects_competing_recovery; it asserts one success, InvalidToken for the competing attempt, and session revocation. The #275 report records 500 consecutive passes.
kayg closed this issue 2026-10-03 12:41:39 +00:00
Sign in to join this conversation.
No labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/calternal#274
No description provided.