mirror of
https://github.com/jcreek/CosmicClash.git
synced 2026-09-10 16:04:04 +00:00
d588898f5d
The just-landed signed workload token embedded (allocation_id, match_id, server_id) as claims. That doesn't actually work for its intended delivery channel: the token is meant to be requested as a GameServerAllocation annotation in the SAME request that asks Agones to pick a server, so at mint time the allocator knows allocation_id (it generates it) but not yet which server_id Agones will return -- server_id only exists in Agones's response, after the annotation request has already been sent. Embedding it was simply not possible for the real caller this was built for; only the (allocator -> signed_token) unit tests and hand-constructed integration tests happened to supply it directly, masking the gap. Fixes it by having the token bind only allocation_id (the one identifier actually known at mint time) plus expiry. match_id/server_id are resolved at verify time from the durable allocations table via the new store.AllocationBindingByAllocationID, keyed by allocation_id -- which the allocator already records immediately after Agones responds. This is strictly stronger, not just a workaround: a caller can no longer claim any match/server pairing at all, even one that happens to be internally consistent -- the binding returned is entirely durable-record-derived. Verified: server/workload's unit tests updated for the new two-field claim shape; server/api's Postgres integration suite gains TestWorkloadVerifierFromSignedTokenNeverTrustsCallerSuppliedBinding (two distinct real allocations each resolve to their own, and only their own, match/server pairing) replacing the now-inapplicable mismatched-triple test. Full `go build ./... && go vet ./... && gofmt -l . && go test ./... -race` and `go test -tags integration ./... -race` both clean; the api integration suite re-run 3x clean against a live postgres:17-alpine container.
38 lines
1.6 KiB
Go
38 lines
1.6 KiB
Go
package store
|
|
|
|
import (
|
|
"context"
|
|
"database/sql"
|
|
)
|
|
|
|
// AllocationBindingByAllocationIDSQL resolves the durable match_id/server_id
|
|
// pairing for an allocation_id. A signed workload token only ever names
|
|
// allocation_id (see workload/signed_token.go for why match_id/server_id
|
|
// aren't embedded in the token itself); this is what lets WorkloadVerify
|
|
// return a binding whose match_id/server_id came from the durable allocator
|
|
// record, not from anything the caller supplied. allocations rows are
|
|
// append-only and never leave 'ALLOCATED' (see allocator_sql.go), so this is
|
|
// a simple existence lookup, not a state-machine walk.
|
|
const AllocationBindingByAllocationIDSQL = `SELECT match_id, server_id FROM allocations
|
|
WHERE allocation_id = $1 AND state = 'ALLOCATED'`
|
|
|
|
// AllocationBindingByAllocationID returns the (matchID, serverID) durably
|
|
// recorded for allocationID, and false if no such allocated row exists. db
|
|
// and allocationID must be non-empty -- callers pass this an
|
|
// already-parsed and signature-verified token's claims, so an empty
|
|
// allocationID here indicates a caller bug rather than a legitimate
|
|
// "not found".
|
|
func AllocationBindingByAllocationID(ctx context.Context, db *sql.DB, allocationID string) (matchID, serverID string, ok bool, err error) {
|
|
if db == nil || allocationID == "" {
|
|
return "", "", false, sql.ErrNoRows
|
|
}
|
|
err = db.QueryRowContext(ctx, AllocationBindingByAllocationIDSQL, allocationID).Scan(&matchID, &serverID)
|
|
if err == sql.ErrNoRows {
|
|
return "", "", false, nil
|
|
}
|
|
if err != nil {
|
|
return "", "", false, err
|
|
}
|
|
return matchID, serverID, true, nil
|
|
}
|