Skip to content

fix(admin): harden stream_route superior_id dependency checks#13672

Merged
shreemaan-abhishek merged 1 commit into
apache:masterfrom
shreemaan-abhishek:fix/stream-route-superior-id-hardening
Jul 8, 2026
Merged

fix(admin): harden stream_route superior_id dependency checks#13672
shreemaan-abhishek merged 1 commit into
apache:masterfrom
shreemaan-abhishek:fix/stream-route-superior-id-hardening

Conversation

@shreemaan-abhishek

Copy link
Copy Markdown
Contributor

Description

Follow-up to #12794, which added dependency-protocol checking and delete protection for stream routes. This PR hardens those checks against a few edge cases:

  • Reject self-reference: a route that sets its own id as protocol.superior_id would otherwise pass the protocol-match check on update (it matches itself). Now rejected at write time.
  • Fail closed on JSON decode errors: core.json.decode returns nil, err on malformed data. Previously a decode failure silently skipped the record, which could hide a live superior_id reference (allowing deletion of an in-use route) or bypass the protocol-mismatch check. Now it returns an error instead of continuing.
  • Explicit status on etcd failure: delete_checker returned nil as the status code on an etcd fetch failure, which surfaces as an unexpected error path. Now returns 503.

Tests

Added two cases to t/admin/stream-routes-subordinate.t:

  • superior_id references itself → 400
  • force-delete of a referenced superior route → succeeds (bypasses the reference check)

Existing cases are unchanged.

Follow-up to apache#12794. Make the superior/subordinate dependency checks
robust against edge cases:

- reject a route that references itself as superior_id (self-reference
  would otherwise pass the protocol-match check on update)
- fail closed on json decode errors instead of silently skipping, so a
  malformed record can not hide a live superior_id reference or bypass
  the protocol-mismatch check
- return an explicit 503 on etcd fetch failure in delete_checker so the
  admin API responds with a proper status code instead of nil

Add self-reference and force-delete test cases.
@dosubot dosubot Bot added size:L This PR changes 100-499 lines, ignoring generated files. bug Something isn't working labels Jul 8, 2026
@shreemaan-abhishek shreemaan-abhishek merged commit 99106e5 into apache:master Jul 8, 2026
16 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working size:L This PR changes 100-499 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants