jb/eden
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: harden residual route and restore checks

Browse Source
This commit is contained in:
jb
2026-09-19 10:01:23 -04:00
parent cb86497724
commit 01b8b4642b
7 changed files with 45 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/restore-rehearsal.md
+22 -2
View File
@@ -136,7 +136,12 @@ allocated loopback ports. Do not use a production callback or provider key.
`SMOKE_ALLOW_WRITE=1`, and record its output without recording secrets. It
exercises login/session, staged publication, failed publication preserving
the previous generation, tenant isolation, JWT audience checks, and local
revocation.
revocation:
```sh
SMOKE_ALLOW_WRITE=1 CONVEX_SELF_HOSTED_URL="http://127.0.0.1:$CONVEX_PORT" \
bun "$repo/scripts/smoke-convex.ts" | tee "$work/convex-smoke.log"
```
Then write a deterministic marker that can be looked up after restore. Use
a fresh marker and synthetic character ID for every rehearsal; do not use a
@@ -144,10 +149,12 @@ allocated loopback ports. Do not use a production callback or provider key.
```sh
export RESTORE_MARKER="$(date -u +%Y%m%dT%H%M%SZ)-synthetic"
export RESTORE_MARKER_CHARACTER_ID=998000001
export RESTORE_MARKER_CHARACTER_ID=4000000001 # reserved synthetic range
export RESTORE_MARKER_SESSION_EXPIRES_AT=$(( $(date +%s) * 1000 + 7 * 24 * 60 * 60 * 1000 ))
SMOKE_ALLOW_WRITE=1 RESTORE_MARKER_CONFIRMATION=DISPOSABLE_LOOPBACK_ONLY \
RESTORE_MARKER_PHASE=write RESTORE_MARKER="$RESTORE_MARKER" \
RESTORE_MARKER_CHARACTER_ID="$RESTORE_MARKER_CHARACTER_ID" \
RESTORE_MARKER_SESSION_EXPIRES_AT="$RESTORE_MARKER_SESSION_EXPIRES_AT" \
CONVEX_SELF_HOSTED_URL="http://127.0.0.1:$CONVEX_PORT" \
bun "$repo/scripts/smoke-restore-marker.ts" | tee "$work/marker-write.log"
```
@@ -216,8 +223,11 @@ allocated loopback ports. Do not use a production callback or provider key.
```sh
RESTORE_MARKER="$RESTORE_MARKER" \
RESTORE_MARKER_CHARACTER_ID="$RESTORE_MARKER_CHARACTER_ID" \
RESTORE_MARKER_SESSION_EXPIRES_AT="$RESTORE_MARKER_SESSION_EXPIRES_AT" \
CONVEX_SELF_HOSTED_URL="http://127.0.0.1:$CONVEX_PORT" \
RESTORE_MARKER_PHASE=verify bun "$repo/scripts/smoke-restore-marker.ts"
SMOKE_ALLOW_WRITE=1 CONVEX_SELF_HOSTED_URL="http://127.0.0.1:$CONVEX_PORT" \
bun "$repo/scripts/smoke-convex.ts" | tee "$work/convex-restore-smoke.log"
```
Verify:
@@ -241,6 +251,16 @@ allocated loopback ports. Do not use a production callback or provider key.
revokes all sessions and quarantines token records, a deployment-specific
credential-version fence, or an equivalent bounded mechanism. Record the
maximum stale-authority window and the decision before reopening traffic.
If implemented for the rehearsal, run the marker check before its explicit
expiry window:
```sh
RESTORE_MARKER="$RESTORE_MARKER" RESTORE_MARKER_CHARACTER_ID="$RESTORE_MARKER_CHARACTER_ID" \
RESTORE_MARKER_SESSION_EXPIRES_AT="$RESTORE_MARKER_SESSION_EXPIRES_AT" \
CONVEX_SELF_HOSTED_URL="http://127.0.0.1:$CONVEX_PORT" \
RESTORE_MARKER_PHASE=expect-invalidated bun "$repo/scripts/smoke-restore-marker.ts"
```
Grant rotation/quarantine behavior is unexecuted until that mechanism
exists; no synthetic provider result can substitute for it.