stackchain/stackchain-dashboard
1
0
Fork 0
Code Issues 9 Pull Requests 1 Actions Packages Projects Releases 713 Wiki Activity

Make destructive actions truthful when security journaling fails #497

New Issue
Closed
opened 2026-08-10 16:19:05 +00:00 by timmy · 0 comments
timmy commented 2026-08-10 16:19:05 +00:00
Owner
Copy Link

Problem

Destructive actions currently write their security event after the irreversible mutation. If that write fails, sign-out can leave an invalid cookie and issue closure can be reported as failed even though Gitea already closed it. Retrying can therefore mislead operators or repeat an action.

Product slice

Add durable reserve/finalize semantics to the security event journal for session revocation and issue closure. Refuse mutation when reservation cannot be persisted; after mutation succeeds, preserve truthful API/browser behavior even if finalization is temporarily unavailable, retaining a pending audit record.

Acceptance criteria

  • A journal reservation failure prevents current/all/remote session revocation and issue closure.
  • Successful current/all-device sign-out clears cookies even when journal finalization fails.
  • Successful issue closure is reported as closed when finalization fails; a durable pending event remains.
  • Failed upstream mutations do not appear as completed successes.
  • Pending/completed history remains bounded, private, and cache-disabled.
  • Behavioral tests cover each failure boundary and the full suite passes.

This is distinct from #493, which introduced successful-path security history but did not make journal/mutation failure ordering atomic or outcome-truthful.

## Problem Destructive actions currently write their security event after the irreversible mutation. If that write fails, sign-out can leave an invalid cookie and issue closure can be reported as failed even though Gitea already closed it. Retrying can therefore mislead operators or repeat an action. ## Product slice Add durable reserve/finalize semantics to the security event journal for session revocation and issue closure. Refuse mutation when reservation cannot be persisted; after mutation succeeds, preserve truthful API/browser behavior even if finalization is temporarily unavailable, retaining a pending audit record. ## Acceptance criteria - A journal reservation failure prevents current/all/remote session revocation and issue closure. - Successful current/all-device sign-out clears cookies even when journal finalization fails. - Successful issue closure is reported as closed when finalization fails; a durable pending event remains. - Failed upstream mutations do not appear as completed successes. - Pending/completed history remains bounded, private, and cache-disabled. - Behavioral tests cover each failure boundary and the full suite passes. This is distinct from #493, which introduced successful-path security history but did not make journal/mutation failure ordering atomic or outcome-truthful.
timmy self-assigned this 2026-08-10 16:19:05 +00:00
timmy closed this issue 2026-08-10 16:32:40 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels   
P0

Drop everything

  
P1

High priority

  
P2

Medium priority

  
agent:nightprowl

Assignments routed to the LongCat NightProwl evaluation worker

  
backend

Backend service

  
ci

Continuous integration / actions

  
frontend

Frontend / UI

  
meta

Meta / planning

  
pages

Gitea Pages

  
template

Repo template / standards

No Label
P0
P1
P2
agent:nightprowl
backend
ci
frontend
meta
pages
template
Milestone
Clear milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
timmy
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: stackchain/stackchain-dashboard#497
No description provided.
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?