Repository navigation
fix(auth): implement proactive TTL eviction for pending SEP-10 challenges - #875
Merged
Merged
Conversation
…nges (Sorokit#763) - Add automatic background timer eviction for expired SEP-10 challenge contexts - Implement O(K) early-exit pruning leveraging uniform TTL insertion monotonicity - Eagerly clean expired challenges on initiateSep10Auth and completeSep10Auth - Evaluate caller-supplied options.now in completeSep10Auth with clear error on expiry - Unreference background timer handle to prevent holding the Node.js event loop - Export pruneExpiredChallenges, getPendingChallengesCount, and clearPendingChallenges helpers - Add unit and integration tests covering idle background eviction and FIFO limits
|
@Gezziy Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
closes #763
Summary of Changes
src/integration/sep10Auth.tsthat removes expired challenge contexts as soon asCHALLENGE_TTL_MS(5 minutes) elapses, preventing memory accumulation in idle deployments..unref()on the background timer handle in Node.js/Bun environments so pending timers do not block clean process exit or CLI operations. WhenpendingChallengesis empty, background timers are cleanly cleared.initiateSep10Auth: Prunes expired entries before evaluatingMAX_PENDING_CHALLENGES(128) and inserting new challenges.completeSep10Auth: Accurately evaluates caller-suppliedoptions.now ?? Date.now(). If expired, rejects immediately with codeINVALID_AUTHand message"SEP-10 challenge has expired."while purging expired entries.pruneExpiredChallenges,getPendingChallengesCount,clearPendingChallenges,CHALLENGE_TTL_MS, andMAX_PENDING_CHALLENGESfromsrc/integration/and rootsrc/index.ts.src/integration/sep10Auth.test.tsverifying idle background eviction via fake timers, expired-but-not-evicted error handling, FIFO limit enforcement at 128 challenges, and staggered multi-challenge expirations.Reason for Changes
Resolves issue #763. Previously,
pendingChallengesonly evicted expired entries when a new challenge was requested viainitiateSep10Auth. In idle deployments, stale challenge contexts remained pinned in memory indefinitely. Furthermore, under traffic bursts approaching the 128-challenge limit, stale entries could cause valid in-flight challenges to be prematurely evicted via FIFO.