fix(daemon): retire expired remote resume credentials

commit: b902d9649a90148dcd65095bcff24b6c7f4f890b
author: brice · 2mo ago · 2026-08-06 20:03 UTC
parent: 28680b3
signature: GPG VerifiedCD88F9E564E0102646FB6077A1A07C7C7C3E349D · arch-gpg Verified for the committer email

3 files · +60 -1

M internal/usecase/daemon/remote_warm.go +3 -0


@@ -124,6 +124,8 @@ func (d Daemon) expireRemoteViewWarm(view remoteView, warm *remoteViewWarm) {
124	124		view.warm = nil
125	125		view.warmGeneration++
126	126		view.closed = true
	127	+	retirements := d.purgeParkedForRemoteViewLocked(view)
	128	+	d.purgeParkingForRemoteViewLocked(view)
127	129		link := view.link
128	130		view.link = nil
129	131		view.linkGeneration++

@@ -135,6 +137,7 @@ func (d Daemon) expireRemoteViewWarm(view remoteView, warm *remoteViewWarm) {
135	137		d.mu.Unlock()
136	138
137	139		warm.stop()
	140	+	d.finishParkedAttachmentRetirements(retirements)
138	141		if link == nil {
139	142		return
140	143		}


@@ -124,6 +124,8 @@ func (d Daemon) expireRemoteViewWarm(view remoteView, warm *remoteViewWarm) {
124	view.warm = nil	124		view.warm = nil
125	view.warmGeneration++	125		view.warmGeneration++
126	view.closed = true	126		view.closed = true
		127	+	retirements := d.purgeParkedForRemoteViewLocked(view)
		128	+	d.purgeParkingForRemoteViewLocked(view)
127	link := view.link	129		link := view.link
128	view.link = nil	130		view.link = nil
129	view.linkGeneration++	131		view.linkGeneration++

@@ -135,6 +137,7 @@ func (d Daemon) expireRemoteViewWarm(view remoteView, warm *remoteViewWarm) {
135	d.mu.Unlock()	137		d.mu.Unlock()
136		138
137	warm.stop()	139		warm.stop()
		140	+	d.finishParkedAttachmentRetirements(retirements)
138	if link == nil {	141		if link == nil {
139	return	142		return
140	}	143		}

M internal/usecase/daemon/remote_warm_test.go +25 -0


@@ -29,6 +29,31 @@ func TestRemoteViewWarmExpiryRemovesOnlyDetachedExactView(t *testing.T) {
29	29		view.mu.Unlock()
30	30		}
31	31
	32	+	func TestRemoteViewWarmExpiryPurgesRemoteResumeCredentials(t *testing.T) {
	33	+	clock := &signalClock{timers: make(chan *signalTimer, 1)}
	34	+	d := newTestDaemon(t, nil, clock)
	35	+	view := registerRemoteWarmTestView(t, d)
	36	+	parked := &attachedClient{resumeToken: 41, parked: true}
	37	+	parking := &attachedClient{resumeToken: 42}
	38	+	d.mu.Lock()
	39	+	d.parked[parked.resumeToken] = &parkedAttachment{owner: view, ac: parked, timer: stubTimer{}, done: make(chan struct{})}
	40	+	d.parking[parking.resumeToken] = &parkingAttachment{owner: view, ac: parking, done: make(chan struct{})}
	41	+	d.mu.Unlock()
	42	+
	43	+	d.parkRemoteViewWarm(view)
	44	+	warm, timer := remoteWarmTimer(t, clock, view)
	45	+	timer.ch <- time.Now()
	46	+	awaitTestCompletion(t, warm.done, "remote warm expiry did not complete")
	47	+
	48	+	d.mu.Lock()
	49	+	require.Empty(t, d.parked)
	50	+	require.Empty(t, d.parking)
	51	+	d.mu.Unlock()
	52	+	require.Zero(t, parked.resumeToken)
	53	+	require.False(t, parked.parked)
	54	+	require.Zero(t, parking.resumeToken)
	55	+	}
	56	+
32	57		func TestRemoteViewWarmActivationFencesStaleExpiry(t *testing.T) {
33	58		clock := &signalClock{timers: make(chan *signalTimer, 1)}
34	59		d := newTestDaemon(t, nil, clock)


@@ -29,6 +29,31 @@ func TestRemoteViewWarmExpiryRemovesOnlyDetachedExactView(t *testing.T) {
29	view.mu.Unlock()	29		view.mu.Unlock()
30	}	30		}
31		31
		32	+	func TestRemoteViewWarmExpiryPurgesRemoteResumeCredentials(t *testing.T) {
		33	+	clock := &signalClock{timers: make(chan *signalTimer, 1)}
		34	+	d := newTestDaemon(t, nil, clock)
		35	+	view := registerRemoteWarmTestView(t, d)
		36	+	parked := &attachedClient{resumeToken: 41, parked: true}
		37	+	parking := &attachedClient{resumeToken: 42}
		38	+	d.mu.Lock()
		39	+	d.parked[parked.resumeToken] = &parkedAttachment{owner: view, ac: parked, timer: stubTimer{}, done: make(chan struct{})}
		40	+	d.parking[parking.resumeToken] = &parkingAttachment{owner: view, ac: parking, done: make(chan struct{})}
		41	+	d.mu.Unlock()
		42	+
		43	+	d.parkRemoteViewWarm(view)
		44	+	warm, timer := remoteWarmTimer(t, clock, view)
		45	+	timer.ch <- time.Now()
		46	+	awaitTestCompletion(t, warm.done, "remote warm expiry did not complete")
		47	+
		48	+	d.mu.Lock()
		49	+	require.Empty(t, d.parked)
		50	+	require.Empty(t, d.parking)
		51	+	d.mu.Unlock()
		52	+	require.Zero(t, parked.resumeToken)
		53	+	require.False(t, parked.parked)
		54	+	require.Zero(t, parking.resumeToken)
		55	+	}
		56	+
32	func TestRemoteViewWarmActivationFencesStaleExpiry(t *testing.T) {	57		func TestRemoteViewWarmActivationFencesStaleExpiry(t *testing.T) {
33	clock := &signalClock{timers: make(chan *signalTimer, 1)}	58		clock := &signalClock{timers: make(chan *signalTimer, 1)}
34	d := newTestDaemon(t, nil, clock)	59		d := newTestDaemon(t, nil, clock)

M internal/usecase/daemon/resume.go +32 -1


@@ -146,6 +146,20 @@ func (d Daemon) purgeParkingForSessionLocked(sess session) {
146	146		}
147	147		}
148	148
	149	+	// purgeParkingForRemoteViewLocked invalidates in-flight resume publication for
	150	+	// one terminal remote view. At this point the view has no attachment members,
	151	+	// so clearing the credential cannot race a live owner.
	152	+	func (d Daemon) purgeParkingForRemoteViewLocked(view remoteView) {
	153	+	for token, pending := range d.parking {
	154	+	if owner, remote := normalizeAttachmentOwner(pending.owner).(*remoteView); remote && owner == view {
	155	+	delete(d.parking, token)
	156	+	pending.ac.resumeToken = 0
	157	+	pending.ac.parked = false
	158	+	pending.closeDone()
	159	+	}
	160	+	}
	161	+	}
	162	+
149	163		// waitParkingInFlight waits for an identified same-client parking publication
150	164		// to finish. Returns true when a matching in-flight entry was observed.
151	165		// Unknown and mismatched credentials return false without waiting.

@@ -353,11 +367,12 @@ func (d Daemon) abortResumeClaim(ac attachedClient) bool {
353	367		ac.parked = true
354	368		ac.connectionGeneration.Add(1)
355	369		sess := localSession(parked.owner)
	370	+	view, remote := normalizeAttachmentOwner(parked.owner).(*remoteView)
356	371		if sess != nil {
357	372		sess.mu.Lock()
358	373		sess.unregisterAttachmentLocked(ac)
359	374		sess.mu.Unlock()
360		-	} else if view, remote := normalizeAttachmentOwner(parked.owner).(*remoteView); remote {
	375	+	} else if remote {
361	376		view.mu.Lock()
362	377		view.unregisterAttachmentLocked(ac)
363	378		view.mu.Unlock()

@@ -383,6 +398,9 @@ func (d Daemon) abortResumeClaim(ac attachedClient) bool {
383	398		if sess != nil {
384	399		d.recalculateSessionGeometryAndInvalidate(sess, nil, "resume.go")
385	400		}
	401	+	if remote {
	402	+	d.parkRemoteViewWarm(view)
	403	+	}
386	404		d.watchParkedTimer(token, rearmed)
387	405		if captured != nil {
388	406		_ = ac.closeCapturedTransport(ac.revokeTransport(captured))

@@ -423,6 +441,19 @@ func (d Daemon) purgeParkedForSessionLocked(sess session) []parkedAttachmentRe
423	441		return retirements
424	442		}
425	443
	444	+	// purgeParkedForRemoteViewLocked retires every resume credential owned by the
	445	+	// exact remote view. The caller completes the returned external cleanup after
	446	+	// releasing d.mu.
	447	+	func (d Daemon) purgeParkedForRemoteViewLocked(view remoteView) []parkedAttachmentRetirement {
	448	+	var retirements []parkedAttachmentRetirement
	449	+	for token, parked := range d.parked {
	450	+	if owner, remote := normalizeAttachmentOwner(parked.owner).(*remoteView); remote && owner == view {
	451	+	retirements = append(retirements, d.retireParkedAttachmentLocked(token, parked))
	452	+	}
	453	+	}
	454	+	return retirements
	455	+	}
	456	+
426	457		func (d *Daemon) purgeAllParkedLocked() []parkedAttachmentRetirement {
427	458		retirements := make([]parkedAttachmentRetirement, 0, len(d.parked))
428	459		for token, parked := range d.parked {


@@ -146,6 +146,20 @@ func (d Daemon) purgeParkingForSessionLocked(sess session) {
146		}	146		}
147		}	147		}
148			148
			149	+	// purgeParkingForRemoteViewLocked invalidates in-flight resume publication for
			150	+	// one terminal remote view. At this point the view has no attachment members,
			151	+	// so clearing the credential cannot race a live owner.
			152	+	func (d Daemon) purgeParkingForRemoteViewLocked(view remoteView) {
			153	+	for token, pending := range d.parking {
			154	+	if owner, remote := normalizeAttachmentOwner(pending.owner).(*remoteView); remote && owner == view {
			155	+	delete(d.parking, token)
			156	+	pending.ac.resumeToken = 0
			157	+	pending.ac.parked = false
			158	+	pending.closeDone()
			159	+	}
			160	+	}
			161	+	}
			162	+
149		// waitParkingInFlight waits for an identified same-client parking publication	163		// waitParkingInFlight waits for an identified same-client parking publication
150		// to finish. Returns true when a matching in-flight entry was observed.	164		// to finish. Returns true when a matching in-flight entry was observed.
151		// Unknown and mismatched credentials return false without waiting.	165		// Unknown and mismatched credentials return false without waiting.

@@ -353,11 +367,12 @@ func (d Daemon) abortResumeClaim(ac attachedClient) bool {
353		ac.parked = true	367		ac.parked = true
354		ac.connectionGeneration.Add(1)	368		ac.connectionGeneration.Add(1)
355		sess := localSession(parked.owner)	369		sess := localSession(parked.owner)
			370	+	view, remote := normalizeAttachmentOwner(parked.owner).(*remoteView)
356		if sess != nil {	371		if sess != nil {
357		sess.mu.Lock()	372		sess.mu.Lock()
358		sess.unregisterAttachmentLocked(ac)	373		sess.unregisterAttachmentLocked(ac)
359		sess.mu.Unlock()	374		sess.mu.Unlock()
360	-	} else if view, remote := normalizeAttachmentOwner(parked.owner).(*remoteView); remote {	375	+	} else if remote {
361		view.mu.Lock()	376		view.mu.Lock()
362		view.unregisterAttachmentLocked(ac)	377		view.unregisterAttachmentLocked(ac)
363		view.mu.Unlock()	378		view.mu.Unlock()

@@ -383,6 +398,9 @@ func (d Daemon) abortResumeClaim(ac attachedClient) bool {
383		if sess != nil {	398		if sess != nil {
384		d.recalculateSessionGeometryAndInvalidate(sess, nil, "resume.go")	399		d.recalculateSessionGeometryAndInvalidate(sess, nil, "resume.go")
385		}	400		}
			401	+	if remote {
			402	+	d.parkRemoteViewWarm(view)
			403	+	}
386		d.watchParkedTimer(token, rearmed)	404		d.watchParkedTimer(token, rearmed)
387		if captured != nil {	405		if captured != nil {
388		_ = ac.closeCapturedTransport(ac.revokeTransport(captured))	406		_ = ac.closeCapturedTransport(ac.revokeTransport(captured))

@@ -423,6 +441,19 @@ func (d Daemon) purgeParkedForSessionLocked(sess session) []parkedAttachmentRe
423		return retirements	441		return retirements
424		}	442		}
425			443
			444	+	// purgeParkedForRemoteViewLocked retires every resume credential owned by the
			445	+	// exact remote view. The caller completes the returned external cleanup after
			446	+	// releasing d.mu.
			447	+	func (d Daemon) purgeParkedForRemoteViewLocked(view remoteView) []parkedAttachmentRetirement {
			448	+	var retirements []parkedAttachmentRetirement
			449	+	for token, parked := range d.parked {
			450	+	if owner, remote := normalizeAttachmentOwner(parked.owner).(*remoteView); remote && owner == view {
			451	+	retirements = append(retirements, d.retireParkedAttachmentLocked(token, parked))
			452	+	}
			453	+	}
			454	+	return retirements
			455	+	}
			456	+
426		func (d *Daemon) purgeAllParkedLocked() []parkedAttachmentRetirement {	457		func (d *Daemon) purgeAllParkedLocked() []parkedAttachmentRetirement {
427		retirements := make([]parkedAttachmentRetirement, 0, len(d.parked))	458		retirements := make([]parkedAttachmentRetirement, 0, len(d.parked))
428		for token, parked := range d.parked {	459		for token, parked := range d.parked {